Security-First Architecture
Anvil v2.1.0 is our most security-focused release yet. Every credential you trust to Anvil is now protected by military-grade encryption, and agents are sandboxed to prevent unauthorized file access.
Encrypted Credential Vault
All API keys, tokens, and credentials are now stored in an AES-256-GCM encrypted vault with Argon2id key derivation. When you first launch Anvil, the setup wizard guides you through creating a vault password — every credential entered afterward is encrypted before it touches disk.
- Envelope encryption — each credential gets its own random 256-bit Data Encryption Key, encrypted under your master Key Encryption Key
- Argon2id KDF — 65MB memory cost, 3 iterations, 4-way parallelism. Resistant to GPU and ASIC brute-force attacks
- Session-based unlock — enter your password once per session. The key lives in memory only and is zeroed on exit
- Automatic migration — existing plaintext credentials are migrated to the vault on upgrade
- Built-in TOTP — generate 2FA codes directly from the CLI with
/vault totp
File Write Sandbox
Agents can no longer write outside your project boundary. Write operations are sandboxed to the project root (detected via .git, Cargo.toml, package.json). Temporary directories and ~/.anvil/ are always allowed.
Native Ollama API
We’ve replaced the OpenAI-compatible shim with Ollama’s native /api/chat endpoint. This gives you proper thinking mode control for reasoning models like qwen3 and deepseek-r1, native NDJSON streaming, and accurate token tracking.
Modular Architecture
The entire codebase has been restructured from 4 monolithic files into 134 focused modules. The largest file dropped from 15,756 to 4,770 lines — a 70% reduction. The result: zero clippy warnings, 394 passing tests, and a codebase that’s far easier to extend and maintain.
Multi-Line Input & UX Improvements
- Input area dynamically expands from 1 to 5 lines based on content
- Ctrl+C clears input; double-tap exits (matching Claude Code behavior)
- Modern OpenAI key format detection (
sk-proj-*,sk-svcacct-*)
By the Numbers
| Metric | Value |
|---|---|
| Language | Rust (100% safe, zero unsafe) |
| Module Files | 134 |
| Total Lines | 63,576 |
| Slash Commands | 90 |
| Tools | 45 |
| Agent Types | 7 |
| Providers | 4 (Anthropic, OpenAI, Ollama, xAI) |
| Tests | 394 passing |
Upgrade
brew upgrade anvil
# or
anvil --updateOn first launch after upgrade, Anvil will prompt you to set up the encrypted vault and migrate existing credentials automatically.
