[1.13.0] — 2026-05-22

Default-relaxed admin patterns (first field-hours feedback). User started actual field testing and reported: "权限所得太死了吧 只能限制 rm 这种危险的 其他的不限制吧 不然 很麻烦的啊" (permissions are too tight — only block real disasters like rm, the rest shouldn't block, otherwise it's too annoying).

This is the first real-use signal. Fix: 2-tier admin patterns.

Changed — pre-tool-danger.sh 2-tier patterns

Refactored check_destructive_admin from "always block all 40+ admin patterns" to:

Tier 1: ADMIN_ALWAYS_BLOCK (real disasters, ~30 patterns, always on):

• mkfs / fdisk / wipefs / blkdiscard — disk wipe
• mount remount,ro / — lock root readonly
• kill -9 1 / kill -9 -1 / pkill systemd / killall systemd — kill PID 1
• setcap cap_setuid+ep — privilege escalation
• useradd -u 0 / useradd -o / usermod -u 0 — root UID backdoor
• passwd -d root — empty root password
• ln -sf X /etc/passwd / /etc/shadow / /bin / /sbin / /boot — auth/critical symlink
• chattr +i /etc/passwd / /etc/shadow / /etc/sudoers — auth file tampering
• source /etc/profile.d/X / . /etc/profile.d/X — privilege boundary

Tier 2: ADMIN_STRICT_ONLY (admin/dev ops, ~250 patterns, opt-in via ~/.claude/.anchor-strict or ANCHOR_STRICT=1):

• systemctl stop/disable/mask <service>
• apt remove -y / apt-get purge -y / dpkg --purge
• pip uninstall -y / npm uninstall -g
• docker system prune -a --volumes / kubectl delete ns
• terraform destroy -auto-approve
• aws/gcloud/az ... delete (cloud nuke)
• iptables -F / nft flush ruleset / ufw disable
• crontab -r / journalctl --vacuum-*
• useradd -G sudo / usermod -aG sudo
• chown -R /etc, mount --bind, sysctl -w kernel.X
• shutdown / poweroff / reboot / halt
• ... and more

Added — /strict command

commands/strict.md — toggle strict mode via file flag or arg:

/strict on        # touch ~/.claude/.anchor-strict
/strict off       # rm ~/.claude/.anchor-strict
/strict status    # report

Or one-shot: ANCHOR_STRICT=1 <command>.

Added — test-v1.13-relaxed-default.py

39 test cases × 2 modes = 78 verifications:

• ALWAYS-block patterns block in both default + strict
• STRICT-only patterns PASS in default, BLOCK in strict
• Legitimate ops always PASS

Updated — existing test files to set ANCHOR_STRICT=1

3 test files use admin patterns; updated to enable strict mode so their assertions still pass:

• test-v1.5.2-admin.py
• test-v1.5.3-fixes.py
• test-v1.10-review-gaps.py

⚠️ Verification status

Could not run regression locally — host classifier was blocking script execution during the v1.13.0 work session. Code changes were verified by:

• git diff review (pre-tool-danger.sh: +107 / -8 lines, refactor only, no checker chain changes)
• shellcheck cleanliness (verified earlier)
• File integrity (all paths resolve)

CI will run the full 16 regression suites on push. If anything fails, will fix in v1.13.1.

Plugin manifest

• Minor 1.12.2 → 1.13.0 (feature release: relaxed default behavior, new /strict command).

[1.12.2] — 2026-05-21

Logo upgrade — user provided a sci-fi anchor logo from ChatGPT image gen. Replaced README hero with the new PNG.

Added

• assets/logo.png (1024×1024, 825 KB) — full-resolution master image with sci-fi chrome anchor + cyan central orb + energy rays + "ANCHOR" wordmark.
• assets/logo-512.png (512×512, 70 KB) — optimized for README hero (12x smaller, same look at typical display size).

Changed

• README.md + README.en.md hero: previously a 780-wide custom SVG banner, now a 280-wide centered PNG logo + <h1>anchor</h1> + tagline. Cleaner, more polished, lets the new logo do the talking.
• Kept old SVG assets (logo.svg, banner.svg, icon.svg) — icon.svg still referenced by .codex-plugin/plugin.json composerIcon.

[1.12.1] — 2026-05-21

Polish release — logo + banner SVG, README hero section.

Added

• assets/logo.svg (240×240) — 5 个金色光点（5 个 hooks）围绕 anchor 主体，hook 点有脉冲动画（脉冲间隔 3.2s，每个 hook 错峰 0.4s）。
• assets/banner.svg (900×240) — 横幅版：左侧 mini-logo + 右侧 "anchor" 大字 + tagline + metric line ("22 commands · 5 hooks · 277+ defense patterns · 7 memory categories")。
• README + README.en.md 顶部居中显示 banner，下方 5 个 badge（CI / Release / License / Tests / Stars）居中。
• 保留旧 assets/icon.svg（512×512，被 .codex-plugin/plugin.json composerIcon 引用）。

Design

• 配色：deep navy #0F2438 渐变到 #2E5C8A（anchor body）+ warm gold #F0B232（hooks）。
• 5 个 hook 节点位置对应 anchor 5 个 hook events: SessionStart / PreToolUse / PostToolUse / Stop / PreCompact。
• Banner 含静态 metric 数据，README 一眼看到 anchor 的规模。

Note

GitHub README 默认不渲染 SVG 动画（安全策略）— 静态版本仍然清晰。直接打开 SVG 文件能看到脉冲动画。

[1.12.0] — 2026-05-21

Documentation split release. User: "我们的那个 md 是不是太长了 能不能分散一点 md 出来啊 一个 md 干一个就行了啊". Single-responsibility splits applied to the two longest docs.

Changed — SKILL.md 410 → 145 lines (-65%)

Moved deep details to 5 new references; kept core 8 rules + 反模式 + 完成清单 + 命令速查在 SKILL.md。

Token savings: ~2650 tokens per session (every session that loads anchor skill — = ~$0.04 Opus / session at v4.7 pricing).

5 new references:

• intent-and-recon.md — 规则 #1 详解（意图清晰 + 60 秒定位 + 反模式）
• coding-discipline.md — 规则 #4 详解（最小改动 / 显式 > 紧凑 / 信任契约 / 并行调用）
• e2e-validation.md — E2E 标准 + 二阶问题自检 + 完成清单
• codex-review-when.md — 规则 #6 详解（何时调 codex review）
• debugging-and-risks.md — 卡住时 观察→假设→验证 + 高代价动作清单

What stayed in SKILL.md:

• 核心八条（带 references 指针）
• 长任务模式简介（指向 autonomous-mode.md）
• 自治模式简介
• 反模式 list（保留 full list — quick reference 价值高）
• 写完代码的最后一件事
• 命令 + references 速查表

Changed — README.md 448 → 182 lines (-59%)

Split into 4 new docs/:

• docs/install.md — 安装/卸载（含 plugin 方式）+ 文件结构
• docs/commands.md — 22 commands 详细分类 + use case + 命名冲突说明
• docs/design.md — 设计原则（核心八条 + 防偏题 + 防记忆衰减 + 跨项目记忆系统）
• docs/codex.md — Codex CLI 详细兼容矩阵 + 工具差异 + plugin 安装

README.md 保留：

• Hero + badges + 数字表
• Quick links 到 5 个 docs
• 实测战报（短）
• 它解决什么（短）
• 1 分钟上手（保留 8-line bash）
• 22 commands 概览（6 类别 summary table）
• 设计要点（短 + 链 docs/design.md）
• Codex / 对比 / 致谢 / License 简短

Verified

• 15 regression suites / 364/364 pass — zero regression
• shellcheck PASS on all 13 shell scripts
• jsonlint PASS on all manifests
• All internal links resolve (verified via Python AST walk on README + 4 new docs)

Plugin manifest

• Minor 1.11.0 → 1.12.0.

[1.11.0] — 2026-05-21

Triple feature release: 自动 save (dream mode) + runtime detection + 命令冲突避免。

Added — Auto-save (dream mode)

skills/anchor/scripts/auto-save.sh 自动保存当前 task list 到 ~/.anchor/saved-tasks/auto-<reason>-<timestamp>.md。用户什么都不用做——hook 触发时静默 save，相当于 anchor 给你 "做梦时也在保存"。

集成点:

• PreCompact hook 触发时（auto-compact 前）→ auto-precompact-*.md
• Stop hook 触发时（autonomous mode + 有 pending tasks）→ auto-stop-*.md

GC: 自动保留最近 20 个 auto-* 文件，更旧的清掉。用户存盘永远不丢：手动 /save 和 auto-save 是分开的（auto-* 只是 fallback）。

Added — Runtime detection

skills/anchor/scripts/_runtime.sh 4-tier 检测当前 CLI runtime（claude-code / codex）:

1. $ANCHOR_RUNTIME env var (用户 explicit override)
2. Parent process name (ps -o comm= -p $PPID)
3. CLI-specific env vars (CLAUDE_CODE_VERSION / CODEX_VERSION / etc.)
4. Default claude-code

SessionStart hook 现在注入 runtime 名 + tool name hints：

• Claude Code → TaskCreate / TaskUpdate / AskUserQuestion / Agent
• Codex → plan_tool / update_plan + 异步询问 in response

Fixed — Command name conflicts with Claude Code builtins

发现 2 个潜在冲突（Claude Code 内建 /cost 和 /resume）：

Migration: install.sh 自动删除旧 cost.md / resume.md（home + codex 两边），再 cp 新文件。重新 install 即升级，无需手动清理。

Changed

• install.sh 现在打印实际命令数（之前 hard-coded "11 commands"，老旧）
• README.md 之前已美化（v1.10.0 release 后）

Verified

• 15 regression suites / 364/364 pass — zero regression
• shellcheck PASS on all 13 shell scripts (含新 _runtime.sh / auto-save.sh)
• jsonlint PASS
• 实测 auto-save: 创建 synthetic task → 跑 auto-save.sh → 文件正确写入 ~/.anchor/saved-tasks/auto-manual-*.md
• 实测 runtime detection: SessionStart 注入 Runtime: claude-code + tool hints
• 实测 rename: Claude Code skill list 显示 /spend /resume-task，无 /cost /resume 冲突

Plugin manifest

• Minor 1.10.0 → 1.11.0.

[1.10.0] — 2026-05-21

Review-feedback release. User gave 8.5/10 review with 3 actionable gaps (gap 3 — auto-recording blocked patterns as pitfalls — was discussed and declined as over-engineering). v1.10.0 fixes the other 3.

Added — Gap 1: 4 new security pattern categories

In ADMIN_DESTRUCTIVE_PATTERNS dispatch table:

• chown -R to system dirs — covers -R[a-zA-Z]* (catching -Rh / -RP / -RHP) + --recursive against /etc, /var, /usr, /bin, /sbin, /lib, /lib64, /boot, /root, /home, /dev, /proc, /sys. Blocks ownership-transfer attacks (chown -R attacker /etc).
• source / . builtin loading privileged scripts — /etc/profile.d/*, process substitution <(...), backticks, $(...), dotfile poisoning vectors all blocked.
• mount --bind / --rbind / -B / --move — namespace-view-changing mounts that can hide files.
• sysctl dangerous kernel params — dmesg_restrict=0, ip_forward=1, kptr_restrict=0, randomize_va_space=0, unprivileged_userns_clone=1, suid_dumpable=1/2, ptrace_scope=0, sysctl -p <file>.

Implementation bug found and fixed: shlex punctuation_chars=True splits $ from (, so \$\( regex missed. Fixed to \$\s*\(.

Fixed — Gap 2: Test path portability

All 14 existing regression test files used HOOK = "skills/anchor/scripts/pre-tool-danger.sh" (relative path) — only worked from repo root. From any other cwd they would silently fail.

Patched all 14 (10 .py + 4 .sh) to use portable resolution: try ~/.claude/skills/anchor/scripts/ first, fall back to $SCRIPT_DIR/../../skills/anchor/scripts/, then relative. Verified by running full 15 suites from /tmp AND repo root — both 364/364 pass.

Fixed — Gap 4: macOS / weird-FS lock fallback completeness

install.sh had a 2-tier lock with silent-WARN-and-proceed fallback when both flock(1) and Python fcntl.flock failed. Added 3rd-tier mkdir-atomicity fallback (POSIX universal, works on ANY filesystem):

LOCK_DIR="${LOCK_FILE}.d"
if ! mkdir "$LOCK_DIR" 2>/dev/null; then
    echo "ERROR: cannot acquire lock — recovery: rmdir $LOCK_DIR if stale" >&2
    exit 1
fi
trap 'rmdir "$LOCK_DIR" 2>/dev/null' EXIT

Now: never silently loses serialization. Either acquires successfully OR exits with clear error + recovery hint.

Declined — Gap 3 (auto-record blocked patterns as pitfalls)

User's review proposed auto-recording PreToolUse-blocked patterns into the ~/.anchor/memory/pitfalls/ index. Declined as over-engineering:

• Blocked cmds ≠ user intent (many are obfuscation tests / accidental triggers)
• Would pollute pitfall index — /recall for real bugs gets noise
• User actively running /pit is the healthy boundary — keeps memory loop curated

Added — test-v1.10-review-gaps.py

31 cases:

• 6 chown (4 BLOCK + 2 PASS regressions)
• 9 source/. (7 BLOCK + 2 PASS regressions)
• 5 mount (4 BLOCK + 1 PASS regression)
• 11 sysctl (8 BLOCK + 3 PASS regressions)

Itself demonstrates the portable-path resolution required by Gap 2.

Verified

• 15 regression suites / 364/364 pass (333 prior + 31 new + 0 regression)
• shellcheck PASS on all 12 shell scripts (CI rules)
• jsonlint PASS on all manifests
• Tests pass from /tmp AND repo root (Gap 2 demo)
• install.sh exits cleanly on Linux (Gap 4 fallback only triggers on weird FS)

Plugin manifest

• Minor 1.9.1 → 1.10.0.

[1.9.1] — 2026-05-21

Phase 1 testing patch — user asked "we just made it, can we test everything?" Wrote a comprehensive end-to-end test suite that exercises every v1.7-v1.9 feature: all 5 hooks, all helper scripts, the memory loop, all 22 commands' file syntax, all 5 templates, install/uninstall idempotency, and plugin manifest consistency.

Added

• evals/regression/test-v1.9-comprehensive.sh — 34 test cases across 7 sections:
  • A. Hook scripts (8) — session-start basic / autonomous-detected / lean-mode-acknowledged; stop hook quiet-vs-block; pre-compact warning; pre-tool danger regression; post-tool lint with weird filenames
  • B. Helper scripts (3) — analyze-events.py output; pitfall-sync.py extraction + write
  • C. Memory loop (9) — full write→index→inject→recall cycle: SessionStart memory index lists pitfalls/decisions/facts; lean mode skips; preferences auto-inject conditional on non-empty content
  • D. Command syntax (3) — frontmatter validity; non-empty; count = 22
  • E. Templates (1) — all 5 templates exist + non-empty
  • F. Install/uninstall (8) — install --no-hooks exits 0; creates skill dir; 22 commands installed; templates dir installed; pitfall-sync.py executable; re-run idempotent; uninstall exits 0 + removes
  • G. Plugin manifest (2) — 3 manifests version-consistent; codex-plugin has interface block

Total regression coverage now

14 suites / 333/333 cases all pass (299 prior + 34 new comprehensive). zero PreToolUse regression. shellcheck PASS on all 11 shell scripts. jsonlint PASS on all manifests.

Plugin manifest

• Patch 1.9.0 → 1.9.1.

[1.9.0] — 2026-05-21

Memory actually-gets-remembered release. User feedback: "主要是能记得住啊 不然记不住没什么用啊" — memory had a write-side (/pit /decide /remember /snapshot) but no auto-pull-side. Claude never proactively recalled past learnings — user had to manually /recall, defeating the purpose.

Added — project-scoped memory index in SessionStart

SessionStart hook now lists titles + dates of all pitfalls / decisions / facts entries for the current project (matched by basename(cwd)). ~30 lines max for typical project. Token-efficient (titles only, not content).

Output example:

## Memory index (project: `my-api`)
_Past learnings for this project. Use `/recall <keyword>` for full content._

### pitfalls (4)
- 2026-04-15 — Redis pipeline cluster slot mismatch
- 2026-04-22 — JWT expiry edge case
- 2026-05-01 — Postgres connection pool exhaustion
- 2026-05-10 — websocket reconnect race

### decisions (2)
- 2026-03-15 — Use Redis Streams over RabbitMQ for event bus
- 2026-04-01 — Backfill via dbt incremental, not adhoc SQL

### facts (1)
- 2026-03-20 — prod DB endpoint + connection limits

→ **Auto-recall reflex**: when user mentions a topic that matches an entry above, run `/recall <topic>` to load full content BEFORE answering.

Added — SKILL.md "auto-recall reflex" rule (#8)

New core rule:

"遇到 topic 先 /recall。SessionStart 注入的 'Memory index' 列出本项目过去 /pit /decide /remember 写过的 topics — 用户提及 matching topic 时，先 /recall <topic> 拉过去经验再回答，不要凭空答。memory index 是 '有记忆' 信号，/recall 拉具体内容。"

This is the actual "remembering" mechanism. Without this rule, memory index would just be context noise. With it, Claude has a clear instruction to use the index as a signal to retrieve past content before answering.

Behavior

Lean mode behavior

Lean mode (/lean on) skips the memory index inject too — saves ~30 lines/session but loses auto-recall reflex. Use only for short Q&A sessions.

Verified

• 13 regression suites / 299/299 pass.
• shellcheck PASS.
• Manual test: created fake pitfall in ~/.anchor/memory/pitfalls/skk/, SessionStart output correctly listed it under "Memory index".

Plugin manifest

• Minor 1.8.1 → 1.9.0.

[1.8.1] — 2026-05-21

Token-savings release. User feedback: "还要省 token". v1.8.0 's SessionStart was injecting active-task.md (60 lines) + preferences.md (30 lines) on every session = ~900 tokens/session overhead. 4 fixes:

Added — /lean command + toggle file

• commands/lean.md — toggle ~/.claude/.anchor-lean flag. When ON, SessionStart skips the active-task.md + preferences.md injection (still keeps project contracts + git branch + autonomous mode status).
• Estimated saving: ~600 tokens/session for long-task injects, ~300 for prefs = ~900 token/session reduction when lean mode is on.
• Trade-off: in lean mode you have to cat ~/.anchor/active-task.md or /recall manually to get historical context. Worth it for short Q&A sessions.

Changed — SessionStart smarter (default mode)

Even without lean mode on, SessionStart is more conservative:

1. active-task.md inject is now project-scoped — only injects if the Project: field inside matches basename(cwd). Previously: injected unconditionally, polluting unrelated sessions with another project's state.
2. active-task.md cap reduced 60 → 40 lines — milestones table is the primary value; deep history available via manual cat.
3. preferences.md inject conditional — only if file has >3 lines (skips empty/template files).
4. preferences.md cap reduced 30 → 20 lines — preferences should be terse.

Net default-mode saving: ~200-400 tokens/session depending on file content.

Verified

• shellcheck PASS on all shell scripts.
• 13 regression suites / 299/299 pass.
• Live test: SessionStart in /tmp (no project) → 4 lines output (lean off) / 6 lines (lean on, includes 1 line lean status notice). In real long-task project: lean off ~80 lines, lean on ~10 lines.

Plugin manifest

• Patch 1.8.0 → 1.8.1.

[1.8.0] — 2026-05-21

Feature release: unified long-term memory system. v1.7.0 added pitfalls-only cross-project index; v1.8.0 generalizes it to a 7-category memory tree (~/.anchor/memory/) + 3 new commands to write into it + upgraded /recall to search all of them.

Added — 3 new memory-write commands

• /remember <category> <content> — generic long-term memory write:
  • pref → ~/.anchor/memory/preferences.md (single file, auto-injected by SessionStart hook)
  • decision → ~/.anchor/memory/decisions/<project>/<file>.md
  • fact → ~/.anchor/memory/facts/<project>/<file>.md
  • todo → ~/.anchor/memory/todos.md (single file)
• /decide <title> — ADR-style architectural decision record. Auto-extracts context / alternatives / consequences from chat history. Writes to ~/.anchor/memory/decisions/<project>/<YYYY-MM-DD>-<slug>.md with full ADR structure (Status / Context / Decision / Alternatives / Consequences / Followup).
• /snapshot <label> — full workspace snapshot (more than /save): task list + git state (branch/diff-stat/log) + active-task.md + modified file contents (top 20) + manifest. Use for long-task major checkpoints or pre-experiment safety. Writes to ~/.anchor/memory/snapshots/<project>/<label>-<timestamp>/.

Changed — /recall upgraded to multi-category

Now searches all 7 memory locations in parallel:

~/.anchor/memory/pitfalls/<project>/      (from /pit)
~/.anchor/memory/decisions/<project>/     (from /decide)
~/.anchor/memory/facts/<project>/         (from /remember fact)
~/.anchor/memory/preferences.md           (from /remember pref)
~/.anchor/memory/todos.md                 (from /remember todo)
~/.anchor/memory/snapshots/<project>/     (from /snapshot)
~/.anchor/saved-tasks/                    (from /save)
~/.anchor/active-task.md                  (current long-task state)

Output groups results by category with emoji headers (📌 Pitfalls / 🏛 Decisions / 📋 Facts / ⚙️ Preferences / ✅ TODOs / 📸 Snapshots / 💾 Saved tasks). Optional filters: --category=X, --project=X, --since=YYYY-MM.

Changed — SessionStart hook auto-injects preferences

session-start-inject.sh now reads ~/.anchor/memory/preferences.md (if exists) and injects the first 30 lines into session context. After a single /remember pref "我用 pnpm 不是 npm", every future session automatically gets that context — no need to re-tell Claude.

Changed — pitfall path migration

• pitfall-sync.py writes to ~/.anchor/memory/pitfalls/<project>/ (v1.8.0 location).
• Backward-compat: if ~/.anchor/pitfalls/<project>/ (v1.7.0 location) exists, auto-migrates on next /pit run via os.rename. Zero data loss.
• recall.md searches both old and new paths during transition.

Memory tree summary

~/.anchor/
├── memory/
│   ├── pitfalls/<project>/<file>.md    (v1.7 → v1.8 migrated)
│   ├── decisions/<project>/<file>.md   (NEW)
│   ├── facts/<project>/<file>.md       (NEW)
│   ├── snapshots/<project>/<file>/     (NEW)
│   ├── preferences.md                  (NEW, SessionStart auto-injected)
│   └── todos.md                        (NEW)
├── saved-tasks/<label>.md              (v1.6.0)
└── active-task.md                      (v1.7.0)

Verified

• 13 regression suites / 299/299 pass (zero PreToolUse regression).
• shellcheck PASS on all 10 shell scripts.
• jsonlint PASS on all manifests.
• Live install: 21 commands + 9 scripts + 5 hooks all wired. Memory dir structure auto-created on first /remember / /decide / /snapshot / /pit invocation.

Total surface (v1.0 → v1.8.0)

• Slash commands: 21 (was 18, +remember/decide/snapshot)
• Hooks: 5 (SessionStart / Stop / PreToolUse / PostToolUse / PreCompact)
• Scripts: 9 (in skills/anchor/scripts/)
• References: 5 (autonomous-mode / multi-agent-recipes / pitfall-template / vuln-checklist / multi-cli-adapters)
• Templates: 5 (web-app / library / cli-tool / data-pipeline / default)
• Regression suites: 13 / 299 cases
• Memory categories: 7 (pitfalls / decisions / facts / preferences / todos / snapshots / saved-tasks)

Plugin manifest

• Minor bump 1.7.0 → 1.8.0.