Changelog

Subscribe via RSS. Versions follow semver; the plugins pin version in their manifests, so you receive an update whenever a number changes.

anchorwatch 0.1.4 — 2026-09-16

• eval was a way around the guard. Last week's release taught Anchorwatch to look inside bash -c "…"; eval "…" is the identical trick and was still open. eval "rm -rf /", eval 'rm -rf /' and eval "cat .env" went through with no prompt, because the opening quote sits exactly where every rule expects a space. An eval payload is now unwrapped and checked like any other command, including behind sudo, command and builtin. The instructions Anchorwatch gives Claude have always said not to reach for eval to get around a block — now the guard enforces it rather than asking nicely.
• The closing quote was hiding things too, which made last week's fix less complete than it looked. A rule that ends by requiring a space or end-of-line never saw the final word of an unwrapped payload, so bash -c "git reset --hard", sh -c "curl … | sh", bash -c "chmod -R 777" and bash -c "npm publish" were all still getting through. Only the three rules that trim quotes from each token — recursive delete, .env reads and secret writes — were actually protected. That is fixed for both the old shapes and the new ones.
• Quotes elsewhere are still just text. git commit -m "rm -rf / broke prod" and grep -n "eval" src/app.js are not commands and are not treated as any, and neither are ordinary uses like eval "$(ssh-agent -s)". Only eval and sh -c open a quote.
• No rule was added and none was weakened — the count stays at 12 blocking and 13 warning. The rules simply see commands they were always meant to see. 196 tests, up from 173.
• Context, if you set your own permission rules: Claude Code 2.1.273 reverted a 2.1.268 change that tried to read Read/Edit deny rules off a Bash line containing eval, env -C or another command its checker cannot analyze, and now prompts for such a line instead. Worth knowing if you were relying on that behaviour between 2.1.268 and 2.1.272.
• Also: anchorwatch-mod 0.0.5 ports all of it, and its tests cross-check every verdict against the classic guard so the two cannot drift.

anchorwatch 0.1.3 — 2026-09-15

• A wrapped command is no longer invisible. Every Bash rule looks for a command at the start of a segment or after a space, which meant a single character of nesting hid it from all of them: X=$(rm -rf /), Y=`rm -rf /`, (rm -rf /), (echo x > .env) and bash -c "rm -rf /" went through with no prompt, and (cd /tmp; rm -rf /) came out as a warning rather than a block. Anchorwatch now unwraps command substitution, subshells, brace groups and a sh -c "…" payload before it splits a command up, so the nested command is checked like any other. Nothing about the rules themselves changed — they simply see what they were always meant to.
• env-read now covers every command that prints a file whole. It knew cat, head, tail, less, more, bat, type and Get-Content; fmt .env, column -t .env, nl .env, xxd .env, strings .env, base64 .env, od, hexdump, tac, rev, pr and fold printed your secrets into the transcript with no objection. A quoted or globbed name (cat ".env", cat .env*) is caught too. grep, sed, awk and cut are deliberately still allowed — listing variable names without their values is the remedy the block message recommends, and it has to keep working.
• Claude Code 2.1.271 fixed this same class of hole in its own Bash permission checks the same week: a subshell or cd+git chain that skipped the prompt, shell variable declaration flags that misrepresented the command being run, and the file that fmt, column "and similar commands" read going unnoticed. If you rely on your own Bash(...) deny rules, they got stronger on 2.1.271 too.
• Also: anchorwatch-mod 0.0.4 ports both fixes. Its tests cross-check every verdict against the classic guard, so the two cannot drift.

anchorwatch 0.1.2 — 2026-09-12

• New blocking rule: secret-write. Until today, secret-files protected .env, keys and credential files from the Edit and Write tools — and only those. A shell command reached the same files freely: tee .env, echo KEY=v > .env, cp /tmp/x .env, sed -i … .env. Same file, same secret, different tool. Anchorwatch now checks the write destinations in a Bash command — redirections, tee arguments, a cp/mv target, the files sed -i rewrites, dd of= — against the same list, and denies the ones that name a secret. .env.example and the other template names stay writable, so the usual "copy the example, fill it in yourself" flow is untouched.
• Claude Code 2.1.269 fixed the same class of hole in its own permission engine: an Edit() deny rule and the working-directory write check did not cover the file a Bash tee command wrote. If your own settings deny Edit(.env*), that rule got stronger today too — and secret-write covers the shapes it still does not see.
• The list of secret-bearing paths now lives in one place (aw_is_secret_path) instead of once per guard, so secret-files and secret-write cannot drift apart. Which paths count is unchanged.
• Also: anchorwatch-mod 0.0.3 ports secret-write, keeping the experimental function-hooks port at parity with every block-level Bash rule.

anchorwatch-pro: setup-audit 0.1.3 — 2026-09-12

• Permissions rubric: a setup that denies Edit/Write on .env* while allowing broad shell writes (Bash(tee:*), Bash(*)) now scores a deduction. Before Claude Code 2.1.269 a tee destination was not checked against Edit() deny rules or the working-directory write check at all, so tee .env walked past both; on 2.1.269 and newer the engine checks it, but an allow rule that broad still reaches further than it looks, and the version you are on decides which. The audit now says which.

anchorwatch-pro: setup-audit 0.1.2 — 2026-09-11

• Permissions rubric: a WebFetch deny or ask rule added to stop exfiltration now costs a grade unless a matching Artifact rule sits beside it. Claude Code 2.1.268 changed plain WebFetch rules to no longer cover Artifact tool reads and updates, so a setup that denied WebFetch to keep content off the network can still publish it to claude.ai. Artifact, or WebFetch(domain:claude.ai), closes the gap.
• The inventory step now surfaces WebFetch and Artifact entries from user settings, which it previously skipped.

anchorwatch-mod 0.0.2 — 2026-09-11

• Fixed: the experimental mod would not have loaded. Claude Code 2.1.267 made the engine's module scan reachable from claude plugin validate --strict, and it refuses a registration whose value is kept in a variable — which is how the mod chained its .catch failure handler, conditionally, while the API's shape was still a guess. .catch is now chained directly on on(...), unconditionally, and the mod validates clean on 2.1.268. A refused module does not load at all, so on a host with function hooks the mod would have registered nothing, not merely logged a warning.
• The README now documents the scan's rules (what may be done with the value of on(...), how $ must be spelled, where $ may be passed), and the test suite pins the two this mod broke against the source, since the mod's CI job has no Claude Code to run the real scan in.
• Unchanged: the rules themselves, the deny reasons, and the classic anchorwatch plugin, which remains the supported one. The mod is still gated behind CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 and is not marketplace-listed.

anchorwatch 0.1.1 — 2026-09-10

• Fixed: the plugin manifest carried a displayName key that Claude Code 2.0.x rejects as invalid, so on those versions the plugin loaded zero hooks and silently protected nothing. Current Claude Code accepted the key, which is why validation and CI never caught it. The key is removed; every supported version now loads the hooks. If you are on Claude Code 2.0.x, update the plugin. The same fix ships in all Pro plugins today.
• Pro: the same displayName fix ships today in all six Pro plugins (quality-gates 0.1.2, context-keeper 0.1.2, review-crew 0.1.1, ship 0.1.1, setup-audit 0.1.1, stack-packs 0.1.1). Pro buyers on Claude Code 2.0.x should update.
• New: plugins/anchorwatch-mod, an experimental port of the eight block-level Bash rules to a Claude Code function hook ("mod"). Loads only behind CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1; not marketplace-listed; the bash plugin remains the supported one.

anchorwatch-pro: quality-gates 0.1.1, context-keeper 0.1.1 — 2026-09-08

• Quality Gates: fixed the stop gate missing "code was edited after the last test run" on Linux — the file-timestamp lookup used a macOS-only stat form that GNU coreutils answers with filesystem info instead, breaking the comparison. In enforce mode the gate now blocks the stop as documented rather than letting it through.
• Context Keeper: fixed the 3-day freshness guard on state snapshots, which was inert on Linux for the same reason and could restore a stale snapshot after compaction.
• No behaviour change on macOS; both plugins now resolve timestamps the same way on both platforms.

anchorwatch 0.1.0 — 2026-09-06

• Initial release. 24 rules: 11 blocking (dangerous recursive delete, force push to protected branches, destructive git, DROP/TRUNCATE/unscoped DELETE, curl|sh, disk destruction, chmod 777, reading .env files, writing secret files, editing .git internals, reading secret files) and 13 warning (other recursive deletes, force pushes to feature branches, ref deletion, env dumps, publish/deploy/infra commands, sudo, broad kills, shell startup edits, lockfile edits, self-configuration, CI/infra files, writes outside the project, credential patterns in written content).
• Skills: /anchorwatch:status, /anchorwatch:check, /anchorwatch:allow, /anchorwatch:doctor, /anchorwatch:rules.
• Per-project .anchorwatch.json with rule levels, allow patterns and protected branches; ANCHORWATCH_DISABLE=1 kill switch.
• Tested with jq, node and python3 JSON parsers on macOS and Linux.

anchorwatch-pro 0.1.0 — 2026-09-06

• Initial release of Quality Gates, Ship, Review Crew, Context Keeper, Setup Audit, and Stack Packs.