anchi-kit 1.2.1 → 1.2.2

package/CURSOR.md

@@ -165,9 +165,61 @@ When executing `/do`:
 
 ---
 
+## 🔒 SILENT SECURITY PROTOCOL (MANDATORY)
+
+> **AI MUST follow silently - no logging, no extra commands.**
+
+### Data Classification (Auto-Apply)
+
+Read `.cursor/data-classification.yaml`:
+
+| Classification      | Action                                     |
+| ------------------- | ------------------------------------------ |
+| 🔴 **CONFIDENTIAL** | Never export full content. Summarize only. |
+| 🟠 **INTERNAL**     | Warn before sharing. No full file exports. |
+| 🟡 **RESTRICTED**   | Check before export to docs/demo.          |
+| 🟢 **PUBLIC**       | Normal operation.                          |
+
+### Auto-Redaction (Always Active)
+
+Mask in outputs:
+
+- API keys: `sk-***`, `AIza***`, `ghp_***`
+- Internal URLs: `localhost:*` → `[LOCAL_URL]`
+- Secrets: `password = "***"`
+- JWT tokens: `eyJ***...`
+
+### Deploy Guard (Silent)
+
+Before deploy actions, check:
+
+- Not using personal account
+- No localhost URLs in production
+- No hardcoded secrets
+
+### Context Boundary
+
+For CONFIDENTIAL/INTERNAL files:
+
+```
+⚠️ This file is classified as [INTERNAL].
+I can summarize, but cannot export full content.
+```
+
+### Compliance (Silent)
+
+- **GDPR**: Minify PII, suggest encryption.
+- **Retention**: Verify log rotation strategy.
+- **Audit**: Log critical security events.
+
+---
+
 ## 📂 RESOURCES
 
 - `.cursor/agents/` - Agent personas
 - `.cursor/skills/` - Domain knowledge
 - `.cursor/commands/` - Command logic
-- `.cursor/agent-skill-index.yaml` - Full orchestration mapping
+- `.cursor/agent-skill-index.yaml` - Orchestration mapping
+- `.cursor/data-classification.yaml` - Security classification
+- `.cursor/deploy-guard.yaml` - Deploy protection
+- `.cursor/compliance/` - Compliance standards

package/README.md

@@ -1,9 +1,9 @@
-**Anchi Kit v1.2.0** - _Don't just code. Orchestrate._ 🚀
+**Anchi Kit v1.2.2** - _Don't just code. Orchestrate._ 🚀
 
 > **The Cognitive Operating System for AI Code Editors**  
 > _"Biến AI từ người thợ code (Junior Coder) thành Kỹ sư trưởng (Senior Tech Lead)."_
 
-[![version](https://img.shields.io/badge/anchi--kit-v1.2.1-blue)](https://www.npmjs.com/package/anchi-kit)
+[![version](https://img.shields.io/badge/anchi--kit-v1.2.2-blue)](https://www.npmjs.com/package/anchi-kit)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 ![Architecture](https://img.shields.io/badge/Architecture-5--Layer-purple)
 ![Orchestration](https://img.shields.io/badge/Orchestration-Dynamic-success)
@@ -166,4 +166,4 @@ Anchi Kit là dự án mã nguồn mở, được xây dựng bởi cộng đồ
 
 ---
 
-**Anchi Kit v1.2.0** - _Don't just code. Orchestrate._ 🚀
+**Anchi Kit v1.2.2** - _Don't just code. Orchestrate._ 🚀

package/docs/reference/ARCHITECTURE.md

@@ -1,4 +1,4 @@
-# anchi-kit Architecture v1.2.0
+# anchi-kit Architecture v1.2.2
 
 > Understanding how anchi-kit works for Cursor AI & Antigravity
 
@@ -25,7 +25,7 @@ anchi-kit is a **unified cognitive toolkit** that provides:
 
 ---
 
-## 🔄 Execution Model (v1.2.0)
+## 🔄 Execution Model (v1.2.2)
 
 ### "One Engine, Multiple Brains"
 
@@ -71,7 +71,7 @@ The core orchestrator adapts its "brain" based on the project's **Primary Domain
 
 ## 📦 Domain Profiles
 
-v1.2.0 introduces **Domain Profiles** to prevent context explosion:
+v1.2.2 introduces **Domain Profiles** to prevent context explosion:
 
 | Profile    | Focus Area      | Primary Agent         | Specialized Packs               |
 | :--------- | :-------------- | :-------------------- | :------------------------------ |

package/docs/reference/ORCHESTRATION.md

@@ -1,4 +1,4 @@
-# Agent Orchestration System v1.2.0
+# Agent Orchestration System v1.2.2
 
 > Meta-layer điều phối AI: Tự nhận thức, tự kiểm soát, tự giải thích  
 > **100% Dynamic Orchestration - Context Aware**
@@ -7,7 +7,7 @@
 
 ## 📜 Mục Lục
 
-1. [Overview - What's New in v1.2.0](#1-overview---whats-new-in-v120)
+1. [Overview - What's New in v1.2.2](#1-overview---whats-new-in-v120)
 2. [Execution Model](#2-execution-model-v121)
 3. [Domain Profiles](#3-domain-profiles-context-isolation)
 4. [Agent Capability](#4-agent-capability--boundary)
@@ -17,11 +17,11 @@
 
 ---
 
-## 1️⃣ Overview - What's New in v1.2.0
+## 1️⃣ Overview - What's New in v1.2.2
 
 ### ✅ Achievements
 
-| Metric           | v1.1.0        | v1.2.0 (Current) | Improvement |
+| Metric           | v1.1.0        | v1.2.2 (Current) | Improvement |
 | :--------------- | :------------ | :--------------- | :---------- |
 | **Architecture** | 5-Layer       | **Domain-Aware** | ✅ Sharp    |
 | **Context**      | Global        | **Isolated**     | ✅ Clean    |
@@ -29,9 +29,9 @@
 
 ---
 
-## 2️⃣ Execution Model (v1.2.0)
+## 2️⃣ Execution Model (v1.2.2)
 
-Mô hình tư duy chuẩn của anchi-kit v1.2.0:
+Mô hình tư duy chuẩn của anchi-kit v1.2.2:
 
 ```
 ┌──────────────────────────────────────────┐
@@ -328,7 +328,7 @@ command_mapping:
       - git-automation
       - changelog-generator
 
-  /clean:  # NEW in v1.2.0
+  /clean:  # NEW in v1.2.2
     default: project-manager
     conditionals:
       - if: "--memory" → docs-manager
@@ -517,7 +517,7 @@ restraint_rules:
 
 ---
 
-## 9️⃣ Agent-Skill Index v1.2.0
+## 9️⃣ Agent-Skill Index v1.2.2
 
 **Complete mapping:** [.cursor/agent-skill-index.yaml](../.cursor/agent-skill-index.yaml)
 
@@ -674,7 +674,7 @@ Available via: /why
 
 ---
 
-## 📊 Migration from v1.0.0 to v1.2.0
+## 📊 Migration from v1.0.0 to v1.2.2
 
 ### Breaking Changes
 
@@ -682,7 +682,7 @@ Available via: /why
 
 ### What Changed
 
-| Component                | v1.x                       | v1.2.0                         |
+| Component                | v1.x                       | v1.2.2                         |
 | ------------------------ | -------------------------- | ------------------------------ |
 | `agent-skill-index.yaml` | 500 lines                  | 834 lines (rewritten)          |
 | Command docs             | Some missing orchestration | All have orchestration section |
@@ -729,7 +729,7 @@ v1.1 Planned:
 
 ---
 
-**v1.2.0 - Zero Static Mappings, 100% Intelligence** 🚀
+**v1.2.2 - Zero Static Mappings, 100% Intelligence** 🚀
 
 **Updated:** 2025-12-29  
 **Maintainer:** Anchi Kit Team

package/docs/team/ONBOARDING.md

@@ -113,4 +113,4 @@ Hãy thử yêu cầu AI làm một việc nhỏ để quen tay.
 
 ---
 
-> **Anchi Kit v1.2.0**
+> **Anchi Kit v1.2.2**

package/docs/team/README.md

@@ -44,4 +44,4 @@ Khi team đã vận hành, hãy dùng các tài liệu này để chuẩn hóa q
 
 ---
 
-> **Anchi Kit v1.2.0** - _Don't just code. Orchestrate Together._ 🚀
+> **Anchi Kit v1.2.2** - _Don't just code. Orchestrate Together._ 🚀

package/docs/team/ROLES_PERMISSIONS.md

@@ -97,4 +97,4 @@ members:
 
 ---
 
-> **Anchi Kit v1.2.0**
+> **Anchi Kit v1.2.2**

package/docs/team/SETUP_GUIDE.md

@@ -118,4 +118,4 @@ Giờ đây dự án đã sẵn sàng.
 
 ---
 
-> **Anchi Kit v1.2.0**
+> **Anchi Kit v1.2.2**

package/docs/team/TEAM_WORKFLOW.md

@@ -94,4 +94,4 @@ Sửa hết lỗi hoặc nhờ AI: `/do "Fix all unit tests"` rồi commit lại
 
 ---
 
-> **Anchi Kit v1.2.0**
+> **Anchi Kit v1.2.2**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anchi-kit",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "The Ultimate AI-Native Toolkit for Cursor & Gemini. Installs into any existing project. Includes commands, agents, skills, and architecture presets.",
   "main": "src/cli.js",
   "bin": {
@@ -39,23 +39,50 @@
     "bin/",
     "src/",
     "scripts/",
-    ".cursor/",
-    ".antigravity/",
+    ".cursor/commands/",
+    ".cursor/agents/",
+    ".cursor/skills/*/SKILL.md",
+    ".cursor/skills/*/references/",
+    ".cursor/workflows/",
+    ".cursor/agent-skill-index.yaml",
+    ".cursor/failure-modes.yaml",
+    ".cursor/orchestration.yaml",
+    ".cursor/team.yaml",
+    ".cursor/data-classification.yaml",
+    ".cursor/deploy-guard.yaml",
+    ".cursor/compliance/",
+    ".cursor/MODEL_COSTS.md",
+    ".cursor/UX_GUIDELINES.md",
+    ".antigravity/commands/",
+    ".antigravity/agents/",
+    ".antigravity/skills/*/SKILL.md",
+    ".antigravity/skills/*/references/",
+    ".antigravity/workflows/",
+    ".antigravity/agent-skill-index.yaml",
+    ".antigravity/failure-modes.yaml",
+    ".antigravity/orchestration.yaml",
+    ".antigravity/team.yaml",
+    ".antigravity/data-classification.yaml",
+    ".antigravity/deploy-guard.yaml",
+    ".antigravity/compliance/",
     "presets/",
     "docs/",
     ".cursorrules",
     "CURSOR.md",
+    "ANTIGRAVITY.md",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
   "dependencies": {
-    "better-sqlite3": "^9.2.2",
     "bottleneck": "^2.19.5",
     "chalk": "^4.1.2",
     "ora": "^5.4.1",
     "prompts": "^2.4.2"
   },
+  "optionalDependencies": {
+    "better-sqlite3": "^9.2.2"
+  },
   "devDependencies": {
     "@commitlint/cli": "^18.4.3",
     "@commitlint/config-conventional": "^18.4.3",
@@ -67,7 +94,6 @@
     "@semantic-release/npm": "^11.0.2",
     "@semantic-release/release-notes-generator": "^12.1.0",
     "@vercel/ncc": "^0.38.4",
-    "anchi-kit": "^1.2.1",
     "conventional-changelog-conventionalcommits": "^7.0.2",
     "husky": "^8.0.3",
     "semantic-release": "^22.0.12"

package/presets/memory-template/.ai-audit/README.md

@@ -0,0 +1,42 @@
+# AI Audit - Decision Logs
+
+This folder stores AI decision audit logs for transparency and debugging.
+
+## Structure
+
+```
+.ai-audit/
+├── README.md           # This file
+└── YYYY-MM-DD.jsonl    # Daily decision logs
+```
+
+## Log Format
+
+Each log entry contains:
+
+- **timestamp**: When the decision was made
+- **action**: What action was taken
+- **reasoning**: Why this action was chosen
+- **context**: Relevant context at decision time
+
+## Usage
+
+```bash
+# View recent audit logs
+npx anchi-kit brain audit
+
+# View specific date
+npx anchi-kit brain audit --date 2024-12-30
+
+# Clear old logs
+npx anchi-kit clean --audit
+```
+
+## Security
+
+⚠️ Audit logs may contain sensitive project details.  
+Add to `.gitignore` for public repositories:
+
+```gitignore
+.ai-audit/
+```

package/presets/memory-template/.ai-memory/README.md

@@ -0,0 +1,42 @@
+# AI Memory - Context Storage
+
+This folder stores AI context, session history, and project knowledge.
+
+## Structure
+
+```
+.ai-memory/
+├── context.json      # Current project context
+├── decisions.json    # Key decisions made
+├── graph/            # Knowledge graph data
+├── sessions/         # Chat session history
+└── vector/           # Vector embeddings (optional)
+```
+
+## Usage
+
+- **context.json**: Auto-managed by anchi-kit
+- **decisions.json**: Important decisions for future reference
+- **sessions/**: Preserves conversation context across sessions
+
+## Security
+
+⚠️ This folder may contain sensitive project information.  
+Add to `.gitignore` if working in a public repository:
+
+```gitignore
+.ai-memory/
+```
+
+## Commands
+
+```bash
+# View memory status
+npx anchi-kit brain memory
+
+# Clear memory
+npx anchi-kit clean --memory
+
+# Export context
+npx anchi-kit memory export
+```

package/presets/memory-template/.ai-memory/context.json

@@ -0,0 +1,11 @@
+{
+  "version": "1.0",
+  "project": "",
+  "description": "",
+  "createdAt": "",
+  "lastUpdated": "",
+  "tech_stack": [],
+  "architecture": "",
+  "conventions": [],
+  "history": []
+}

package/presets/memory-template/.ai-memory/decisions.json

@@ -0,0 +1 @@
+[]

package/presets/memory-template/.ai-memory/graph/.gitkeep

@@ -0,0 +1 @@
+# Graph data placeholder

package/presets/memory-template/.ai-memory/sessions/.gitkeep

@@ -0,0 +1 @@
+# Session history placeholder

package/presets/memory-template/.ai-memory/vector/.gitkeep

@@ -0,0 +1 @@
+# Vector embeddings placeholder

package/presets/professional/contract.json

@@ -1,7 +1,7 @@
 {
     "name": "professional",
     "displayName": "Professional",
-    "version": "1.2.0",
+    "version": "1.2.2",
     "architecture": {
         "type": "modular-monolith",
         "database": "PostgreSQL",

package/presets/rapid/contract.json

@@ -1,7 +1,7 @@
 {
     "name": "rapid",
     "displayName": "Rapid MVP",
-    "version": "1.2.0",
+    "version": "1.2.2",
     "architecture": {
         "type": "flat",
         "database": "SQLite",

package/scripts/pre-commit-secrets.ps1

@@ -0,0 +1,84 @@
+# =============================================================================
+# anchi-kit Pre-Commit Hook - Secret Scanner (PowerShell)
+# Prevents committing files containing API keys, passwords, tokens
+# =============================================================================
+
+Write-Host "🔒 anchi-kit: Scanning for secrets..." -ForegroundColor Green
+
+# Secret patterns to detect
+$patterns = @(
+    'sk-[a-zA-Z0-9]{20,}',                     # OpenAI
+    'AIza[a-zA-Z0-9_-]{35}',                    # Google API
+    'ghp_[a-zA-Z0-9]{36}',                      # GitHub PAT
+    'gho_[a-zA-Z0-9]{36}',                      # GitHub OAuth
+    'xox[baprs]-[a-zA-Z0-9-]+',                 # Slack
+    'AKIA[A-Z0-9]{16}',                         # AWS Access Key
+    'sk-ant-[a-zA-Z0-9_-]+',                    # Anthropic
+    'api[_-]?key\s*[=:]\s*[''"][^''"]{10,}[''"]', # Generic API key
+    'password\s*[=:]\s*[''"][^'']+[''"]'        # Hardcoded password
+)
+
+$foundSecrets = $false
+$stagedFiles = git diff --cached --name-only --diff-filter=ACMR 2>$null
+
+if (-not $stagedFiles) {
+    Write-Host "✅ No staged files to scan" -ForegroundColor Green
+    exit 0
+}
+
+foreach ($file in $stagedFiles) {
+    # Skip binary and media files
+    if ($file -match '\.(png|jpg|jpeg|gif|ico|woff|woff2|ttf|eot|pdf|zip|tar|gz)$') {
+        continue
+    }
+    
+    # Skip node_modules and .git
+    if ($file -match '^node_modules/' -or $file -match '^\.git/') {
+        continue
+    }
+    
+    # Skip .env.example files
+    if ($file -match '\.env\.example$') {
+        continue
+    }
+    
+    if (Test-Path $file) {
+        $content = Get-Content $file -Raw -ErrorAction SilentlyContinue
+        if ($content) {
+            $lineNum = 0
+            $lines = $content -split "`n"
+            
+            foreach ($pattern in $patterns) {
+                for ($i = 0; $i -lt $lines.Count; $i++) {
+                    if ($lines[$i] -match $pattern) {
+                        Write-Host ""
+                        Write-Host "🚨 POTENTIAL SECRET DETECTED" -ForegroundColor Red
+                        Write-Host "   File: $file" -ForegroundColor Yellow
+                        Write-Host "   Line $($i + 1): [REDACTED]" -ForegroundColor Red
+                        $foundSecrets = $true
+                    }
+                }
+            }
+        }
+    }
+}
+
+if ($foundSecrets) {
+    Write-Host ""
+    Write-Host "════════════════════════════════════════════════════════════" -ForegroundColor Red
+    Write-Host "   ⛔ COMMIT BLOCKED - Secrets detected in staged files" -ForegroundColor Red
+    Write-Host "════════════════════════════════════════════════════════════" -ForegroundColor Red
+    Write-Host ""
+    Write-Host "💡 How to fix:" -ForegroundColor Yellow
+    Write-Host "   1. Move secrets to .env file"
+    Write-Host "   2. Use process.env.YOUR_SECRET_NAME in code"
+    Write-Host "   3. Add .env to .gitignore"
+    Write-Host ""
+    Write-Host "💡 To bypass (NOT RECOMMENDED):" -ForegroundColor Yellow
+    Write-Host "   git commit --no-verify"
+    Write-Host ""
+    exit 1
+}
+
+Write-Host "✅ No secrets detected - commit allowed" -ForegroundColor Green
+exit 0

package/scripts/pre-commit-secrets.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# =============================================================================
+# anchi-kit Pre-Commit Hook - Secret Scanner
+# Prevents committing files containing API keys, passwords, tokens
+# =============================================================================
+
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+echo -e "${GREEN}🔒 anchi-kit: Scanning for secrets...${NC}"
+
+# Secret patterns to detect
+PATTERNS=(
+    'sk-[a-zA-Z0-9]{20,}'                    # OpenAI
+    'AIza[a-zA-Z0-9_-]{35}'                   # Google API
+    'ghp_[a-zA-Z0-9]{36}'                     # GitHub PAT
+    'gho_[a-zA-Z0-9]{36}'                     # GitHub OAuth
+    'xox[baprs]-[a-zA-Z0-9-]+'                # Slack
+    'AKIA[A-Z0-9]{16}'                        # AWS Access Key
+    'sk-ant-[a-zA-Z0-9_-]+'                   # Anthropic
+    '[a-zA-Z0-9_-]*api[_-]?key[a-zA-Z0-9_-]*\s*[=:]\s*['\''"][^'\''"]{10,}['\''"]'  # Generic API key
+    'password\s*[=:]\s*['\''"][^'\''"]+['\''"]'  # Hardcoded password
+)
+
+FOUND_SECRETS=0
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null)
+
+if [ -z "$STAGED_FILES" ]; then
+    echo -e "${GREEN}✅ No staged files to scan${NC}"
+    exit 0
+fi
+
+for file in $STAGED_FILES; do
+    # Skip binary files and common non-code files
+    if [[ "$file" =~ \.(png|jpg|jpeg|gif|ico|woff|woff2|ttf|eot|pdf|zip|tar|gz)$ ]]; then
+        continue
+    fi
+    
+    # Skip node_modules and .git
+    if [[ "$file" =~ ^node_modules/ ]] || [[ "$file" =~ ^\.git/ ]]; then
+        continue
+    fi
+    
+    # Skip .env.example files (they should have placeholders)
+    if [[ "$file" =~ \.env\.example$ ]]; then
+        continue
+    fi
+    
+    if [ -f "$file" ]; then
+        for pattern in "${PATTERNS[@]}"; do
+            MATCHES=$(grep -nE "$pattern" "$file" 2>/dev/null | head -5)
+            if [ -n "$MATCHES" ]; then
+                echo ""
+                echo -e "${RED}🚨 POTENTIAL SECRET DETECTED${NC}"
+                echo -e "${YELLOW}   File: $file${NC}"
+                echo "$MATCHES" | while read -r line; do
+                    LINE_NUM=$(echo "$line" | cut -d: -f1)
+                    echo -e "   Line $LINE_NUM: ${RED}[REDACTED]${NC}"
+                done
+                FOUND_SECRETS=1
+            fi
+        done
+    fi
+done
+
+if [ $FOUND_SECRETS -eq 1 ]; then
+    echo ""
+    echo -e "${RED}════════════════════════════════════════════════════════════${NC}"
+    echo -e "${RED}   ⛔ COMMIT BLOCKED - Secrets detected in staged files${NC}"
+    echo -e "${RED}════════════════════════════════════════════════════════════${NC}"
+    echo ""
+    echo -e "${YELLOW}💡 How to fix:${NC}"
+    echo "   1. Move secrets to .env file"
+    echo "   2. Use process.env.YOUR_SECRET_NAME in code"
+    echo "   3. Add .env to .gitignore"
+    echo ""
+    echo -e "${YELLOW}💡 To bypass (NOT RECOMMENDED):${NC}"
+    echo "   git commit --no-verify"
+    echo ""
+    exit 1
+fi
+
+echo -e "${GREEN}✅ No secrets detected - commit allowed${NC}"
+exit 0

package/src/cli.js

@@ -13,10 +13,12 @@ const PACKAGE_VERSION = (() => {
     try {
         const pkgPath = path.join(__dirname, '..', 'package.json');
         if (fs.existsSync(pkgPath)) {
-            return JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version || '1.2.0';
+            return JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version || '1.2.2';
         }
-    } catch (e) {}
-    return '1.2.1';
+    } catch (e) {
+        // Fallback if package.json not found or malformed
+    }
+    return '1.2.2'; // Fallback if package.json not found
 })();
 
 // =============================================================================
@@ -435,6 +437,12 @@ if (flags.includes('--version') || flags.includes('-v')) {
     process.exit(0);
 }
 
+// Handle --help flag early
+if (flags.includes('--help') || flags.includes('-h')) {
+    showHelp();
+    process.exit(0);
+}
+
 async function main() {
     // Aliases
     switch (command) {
@@ -559,6 +567,17 @@ async function main() {
             await scout(args.slice(1));
             break;
 
+        case 'scan':
+            const { scan } = require('./commands/scan');
+            const scanExitCode = await scan(args[1]);
+            process.exitCode = scanExitCode;
+            break;
+
+        case 'security':
+        case 'sec':
+            const { security } = require('./commands/security');
+            await security(args[1], args[2]);
+            break;
 
         case 'help':
             showHelp();
@@ -590,8 +609,10 @@ function showHelp() {
     log.success('  npx anchi-kit clean        Cleanup Project');
     log.success('  npx anchi-kit dashboard    Web Dashboard (Port 4567)');
     log.success('  npx anchi-kit tui          Terminal UI (Interactive)');
-    log.success('  npx anchi-kit team         Team Management (New)');
+    log.success('  npx anchi-kit team         Team Management');
     log.success('  npx anchi-kit scout        Knowledge Graph Search & Ingest');
+    log.success('  npx anchi-kit scan         🔒 Scan for secrets in code');
+    log.success('  npx anchi-kit security     🔐 Security management');
     console.log('');
     
     console.log('Brain Commands (via "brain [...]"):');