Text selection and better mouse support

Just a few QOL improvements to the prompt editor and session picker for the weekend!

Text selection

Hold shift and use the arrow keys or click and drag with your mouse to select text in the prompt editor. From there, you can use any of the fancy new shortcuts 👀

• ctrl+shift+a selects everything
• ctrl+shift+c copies the selection
• ctrl+shift+x cuts the selection
• ctrl+shift+v pastes text

Typing or pasting over selected text replaces it.

Mouse support in the session picker

We've been missing mouse support in the session picker for too long! You can now scroll through sessions with the mouse wheel, click an entry to select it, or double-click to open it.

A small Windows fix

Pressing a modifier key by itself could send some dialogs back to the top on Windows. They should stay put now.

Keep crushing!
Charm 💌

Changelog

New!

• 08552fb: feat: textarea selection (#3507) (@andrinoff)
• 90bc466: session picker: add mouse support (@Amolith)

Fixed

• 8661a1c: fix(windows): scrolling up on modifier keys alone (#3598) (@andrinoff)

Other stuff

• 37f36e9: chore: auto-update files (@charmcli)
• 7d78d74: chore: standardize go toolchain on v1.26.6 (#3592) (@aleksclark)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.91.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.91.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.91.0 Latest

Latest

Compare

Choose a tag to compare

Tiny patch

This is a tiny release, but we thought it would be worth it.

• Updated Bubble Tea with a couple fixes for some terminal emulators.
• Updated Fantasy with fixes for AWS SSO and better cache hitting.
• Fixed wrong background color on permissions dialog. This was a regression from adding Bash syntax highlighting on v0.89.0.
• Updated our .gitattributes to make development easier on Windows. We're normalizing LF (instead of CRLF) as line breaks to fix some tests on Windows.

Changelog

Fixed

• ed15da4: fix(ui): use dialog background for bash syntax highlighting in permissions (#3575) (@andreynering)

Other stuff

• 0f14334: chore: normalize line endings to lf via .gitattributes (#3555) (@Lin-BoYuan)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.90.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.90.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.90.0

Compare

Choose a tag to compare

A couple QoL goodies

We're releasing a few Quality of Life ™️ enhacements for you. They're simple, but these simple improvements compound with time to make Crush better and better.

Hint on quitting Crush

When quitting Crush, you'll see a splash screen with a hind on how to quickly continue from the session you left.

Bash tool syntax highlighting

When displaying what Crush is running using the Bash tool, the shell command will now have syntax highlighting. It's a small addition, but definitely improves legibility.

Moo 🐮

ctrl+end to jump to bottom + follow

If you want to quickly jump to the bottom of the chat, you can now just press ctrl+end. This will also ensure Crush will follow the chat as new messages arrive.

MCP improvements

We enhanced things to make it more stable and fix a couple of edge-case bugs.

That's all for today. See you in the next release!
Charm 💌

Changelog

New!

• 804324f: feat(session): print session id on exit (#3398) (@BrunoKrugel)
• b82d7d0: feat(session): restore last used provider/model from session (@meowgorithm)
• 90b48cd: feat(ux): add bash syntax highlighting to bash tool (@andreynering)
• 36a4f79: feat(ux): strip redundant cd-to-project prefix from bash tool display (@andreynering)
• 25bf6a2: feat: ctrl+end to go to the bottom and follow (#3535) (@andrinoff)
• 01da7bc: feat: use anthropic sdk from upstream (#3544) (@andreynering)

Fixed

• c78cc67: fix(mcp): only wait for slow MCP servers in non-interactive runs (@meowgorithm)
• 48768f8: fix(ui): don't block interactive prompts on MCP initialization (@meowgorithm)
• ec2fe43: fix: send hyper api key when fetching provider catalog (#3546) (@andreynering)

Other stuff

• f50509d: chore(mcp): log how long each MCP server takes to connect (@meowgorithm)
• 2e02413: chore: auto-update files (@charmcli)
• feb6300: telemetry: differentiate invocation types (#3533) (@Amolith)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.89.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.89.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.89.0

Compare

Choose a tag to compare

It’s Time for a Bugfix Throwdown

This release is all about stability and quality of life with a buncha fixes around MCP, server-client, and odds and ends. Here's what’s inside:

• UX: Typing clear in the command will match Summarize; thanks, @joestump!
• LSP: @piakdev fixed a case where LSP could panic
• MCP: Slow loading MCPs could block messages from being sent: we reduce default timeout
• Server-Client: MCP OAuth didn't work in server-client mode; now it does
• Server-Client: Clients in the same workspace could kill each other: not anymore
• Server-Client: When the server is running over TCP keystrokes no longer hit the server and slow everything down
• Hyper: Added various small improvements for better UX

Thanks for using Crush. Have good weekend!
Charm 💌

Changelog

New!

• cfad814: feat(dialog): alias clear to summarize in command palette (#3464) (@joestump)

Fixed

• bdad0f1: fixmcp): don't hold callback port open permanently (#3481) (@taciturnaxolotl)
• 1134a5d: fix(dialog): raise permission-guard quiet period to survive natural typing pauses (#3393) (@albatrossflyon-coder)
• 768ffad: fix(hyper): keep working cache when provider cache can't be written (@meowgorithm)
• 9efc08c: fix(hyper): render error messages from back-end (#3513) (@andreynering)
• 42f3ce0: fix(lsp): handle window/workDoneProgress/create to prevent server crash (#3445) (@piakdev)
• 604a7e3: fix(providers): swap the provider cache instead of rewriting it (@meowgorithm)
• 85d83ce: fix(server): keep concurrent sessions from killing each other (@meowgorithm)
• ebd1857: fix(server): mcp auth in client-server mode (@meowgorithm)
• 71fa577: fix(server): release test DB before Windows temp-dir cleanup (@meowgorithm)
• 390ee36: fix(server): replace stale servers that predate shutdown_if_idle (@meowgorithm)
• 7cdef9e: fix(server): typing lag over TCP in client/server mode (@meowgorithm)
• cf4f4df: fix(server): widen permission cross-client test timeout to stop CI flake (@meowgorithm)
• 69080c9: fix(workspace): retire integration-test clients so the DB closes (@meowgorithm)
• 8fd69b4: fix(workspace): wait for recovery notice before asserting resync (@meowgorithm)
• bb3d449: fix: reduce default and suggested mcp timeout (#3509) (@andreynering)

Docs

• 5f11f8e: docs(agents): mark crushrc as primary config format over crush.json (@meowgorithm)
• d99076e: docs: add missing OAuth flags to mcp add in crush-config skill (@pshickeydev)

Other stuff

• 97ac154: chore(mcp,ui): make 'needs auth' color tang, consolidate theme naming (@meowgorithm)
• 9882a88: hyper: hide hypercredits if the server sends USD as the monetary unit (@meowgorithm)
• fb0f6c5: refactor(server): tidy mcp client-server auth wiring (@taciturnaxolotl)
• b109e35: refactor(ui): route all agent-model rebuilds through one helper (@taciturnaxolotl)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.1/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.1/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.88.1

Compare

Choose a tag to compare

.crushrc is here!

Hey! Hope everybody had a great week. We were pretty productive at Charm and we're releasing some cool stuff today.

Bash configuration! (.crushrc)

Yep, .crushrc has come! You existing JSON config still works, but we just started migrating to something a lot more flexible!

An example on why this is cool: if you manage Crush config in a dotfiles repo, you can still have machine-specific overrides by using source to call a separate file that will be in your .gitignore. I'm sure there are many other use cases.

To read the full documentation on this, read this document.

See a snipped so you have an idea on how it looks:

# Add Ollama.
provider add ollama --type ollama --base-url "http://localhost:11434/v1"

# Register a model on Ollama.
model add ollama/llama3.3 --name "Llama 3.3" --context-window 128000

# Auto-approve some tools.
permissions allow view edit

# Add an MCP server
mcp add github \
  --type http \
  --url "https://api.githubcopilot.com/mcp/" \
  --header Authorization "Bearer $GITHUB_TOKEN"

# Load some extra config
source "$XDG_CONFIG_HOME/squid-config.sh"

# Change config based on the machine you're on.
if [[ $HOSTNAME == "babysquid" ]]; then
    option skill-path "$HOME/squid-skills"
fi

Want to give feedback? Join the #crush channel on Discord.

Better AWS Bedrock SSO support

@jan-xyz did a great job bringing this one to life!

When using AWS Bedrock via SSO, tokens expire with time and need to be refreshed. Crush now has a proper configuration and UX for authenticating, and it will appear whenever tokens need to be refreshed.

To read more about it, see #2886.

More reliable Agent Fetch

@sven2718 contributed with better retries in searches when they don't work in the first try. Searches will be more reliable now, specially when doing many in a short period of time.

Fix for Fable 5

@sven2718 also contributed with a fix for Fable 5. When Anthropic decides to reject your prompt for security reasons, we'll now a proper error message in Crush. Before, Crush would just stop without giving context on why.

Crush now compiles on IlluminOS

Never heard of IllumiOS? Neither none of us at Charm, but @timotheosh adjusted the code to ensure it compiles there now!

Go compiles to many environments, and it's always fun to see Crush working on more operating systems! By the way, do you know you can use Crush on Android? 🤖

Enhanced MCP OAuth

In the last release, we shipped support for OAuth authentication for MCPs.

@BrunoKrugel did a few fixes to make more MCPs that require OAuth work as expected.

Agentic fixes

Quite a few fixes were made to Crush as an agent as well. Some of these were made on Fantasy and brought to Crush.

New Hyper models

Not less important, we keep bringing updates to Hyper, which is more stable than ever and has Minimax M3 and Qwen3.7-Flash avalable now.

A lot happened this week! We hope you enjoy, and Keep Crushing ™️!
Charm

Changelog

New!

• 9e3ed61: feat(bedrock): retry the turn automatically after AWS SSO re-auth (@jan-xyz)
• 7810d03: feat(config): apply top-level env vars on startup (@jan-xyz)
• 155072b: feat(noninteractive): make the spinner text use terminal default (@taciturnaxolotl)
• 1c07454: feat(oauth): give the browser redirect a real landing page (@taciturnaxolotl)
• c741463: feat: add "option reset" to wipe shell config list options (@meowgorithm)
• 987ba71: feat: add crush.sh discovery and loading (@meowgorithm)
• 528d837: feat: add permissions deny to hide tools from the agent (@meowgorithm)
• a5156e6: feat: add provider-model builtin for defining provider models (@meowgorithm)
• 3f54c0e: feat: add shell config builtins and ConfigBuilder infrastructure (@meowgorithm)
• c2b8f16: feat: add structured logging to shell config builtins (@meowgorithm)
• 9d31a1a: feat: add verb-first hook add/remove shell config commands (@meowgorithm)
• eea3bf7: feat: add verb-first lsp add/remove shell config commands (@meowgorithm)
• 9a3cdbf: feat: add verb-first mcp add/remove shell config commands (@meowgorithm)
• 52e041c: feat: clarify model pricing flags in crushrc (@meowgorithm)
• c6fb635: feat: configure attribution from crushrc (@meowgorithm)
• e99b8d6: feat: expose CRUSH_VERSION to shell config scripts (@meowgorithm)
• 0b58461: feat: expose remaining advanced config through crushrc (@meowgorithm)
• 8bf07da: feat: make permissions use verb-first allow subcommand (@meowgorithm)
• 650bf3c: feat: rename shell config to crushrc with local .crushrc override (@meowgorithm)
• 479da0f: feat: verb-first provider and model shell config commands (@meowgorithm)

Fixed

• 5e1cd7e: (fix: fable) surface model refusals in the TUI instead of silently stopping work (#3453) (@sven2718)
• 63dc1f0: fix(auth): stop parallel sessions from invalidating each other's login (@taciturnaxolotl)
• 2161989: fix(config): capture rollback snapshot before configureProviders (@taciturnaxolotl)
• 20e4dbc: fix(config): only warn when JSON and crushrc keys actually conflict (@taciturnaxolotl)
• 4dd4442: fix(config): retry transient Windows rename failures in atomicWriteFi… (#3469) (@joestump-agent)
• c7a5999: fix(config): track all discovered config paths for staleness (@taciturnaxolotl)
• ecdc6ed: fix(config): validate crushrc JSON output, skip empty config paths (@taciturnaxolotl)
• b679ba1: fix(edit): auto-correct whitespace mismatches in edit tool (@taciturnaxolotl)
• 677046d: fix(illumos): support building and running crush" (#3422) (@timotheosh)
• 560986c: fix(mcp): MCP server loading in server-client mode (@meowgorithm)
• 2ca5a8c: fix(mcp): normalize oauth metadata redirects (#3415) (@BrunoKrugel)
• e68041a: fix(mcp): pin go-sdk to main for protocol version header fix (#3421) (@taciturnaxolotl)
• c3fd60e: fix(mcp): remove orphaned tokens from oauths MCP (#3418) (@BrunoKrugel)
• 3a71bdf: fix(noninteractive): don't block non interactive mode on session title (@taciturnaxolotl)
• 954deae: fix(server): deliver permission and question events reliably to clients (@taciturnaxolotl)
• 359c13f: fix(shellconfig): assert section/childMap don't overwrite non-map values (@taciturnaxolotl)
• a45ab25: fix(shellconfig): bound crushrc execution with context and timeout (@taciturnaxolotl)
• f14e773: fix(shellconfig): dedup model add, document optionSpecs, pin deny target (@taciturnaxolotl)
• de67123: fix(tools): surface DuckDuckGo rate limiting instead of empty results (@sven2718)
• 80ce583: fix(ui): prevent double spinner on session reload after kill (#3457) (@taciturnaxolotl)
• b0c8c24: fix: accept mixed-case booleans in shell config (@meowgorithm)
• f13f8eb: fix: discover global crush.sh, not just crush.json (@meowgorithm)
• 601f7f7: fix: make crushrc source test pass on Windows (@meowgorithm)
• 7d8e93f: fix: never execute crushrc from machine data directories (@meowgorithm)
• ad70935: fix: resolve short session IDs in local 'crush run --session' (#3460) (@taciturnaxolotl)
• 884391f: fix: stop long thinking blocks from re-rendering the entire document every frame (#3454) (@taciturnaxolotl)

Docs

• 6fc7800: docs(config): add notes on future state migration, update readme/docs (@meowgorithm)
• d8cae42: docs(config): add windows paths, copyedits (@meowgorithm)
• 77444e4: docs(config): make documentation more human (@meowgorithm)
• 0813dcb: docs(crushrc): note that empty headers are dropped from requests (@meowgorithm)
• da35cd7: docs(readme): improve flow of configuration section a bit (@meowgorithm)
• 874c0af: docs(readme): update readme per bash-based config (@meowgorithm)
• f02ffbc: docs(ui): capture dialog rendering and chat perf rules (@taciturnaxolotl)
• 6f9b90c: docs: add config guide and future-work notes (@meowgorithm)
• 6421a2b: docs: default crush-config skill to the crush.sh format (@meowgorithm)
• 810168b: docs: document aws_auth_refresh and top-level env config (@taciturnaxolotl)
• 5d8af19: docs: finish crushrc examples and option help (@meowgorithm)
• 3c736be: docs: fix typos, grammar, and document deny-wins precedence (@taciturnaxolotl)
• f8c83fb: docs: fix version typo and clarify config trust wording (@meowgorithm)
• 5e735ec: docs: lead README configuration with the crush.sh format (@meowgorithm)
• e3dee0b: docs: note the deferred visible-but-always-denied tool state (@meowgorithm)
• 7b8f59f: docs: present crushrc commands as CLI-style help (@meowgorithm)
• b55a092: docs: update AGENTS.md with Bash config format (@meowgorithm)
• 812dc09: docs: use a local Ollama example in the config quick-start (@meowgorithm)

Other stuff

• 5b88f46: bench(config): add crushrc load benchmark (@taciturnaxolotl)
• 0e7db4a: chore(crushrc): drop deadcode (@meowgorithm)
• 7aef231: chore(crushrc): log conflicting keys when json and crushrc compete (@meowgorithm)
• 38f5d98: chore: auto-update files (@charmcli)
• d15f793: chore: auto-update files (@charmcli)
• 100c8bd: chore: auto-update files (@charmcli)
• aa57f56: chore: auto-update files (@charmcli)
• abceac2: chore: auto-update files (@charmcli)
• f4ff2ea: chore: bump fantasy to v0.39.0 (#3470) (@taciturnaxolotl)
• b83944c: chore: bump mcp sdk to 1.7.0 (#3447) (@taciturnaxolotl)
• 618a118: chore: format (@taciturnaxolotl)
• def12cc: chore: gufumpt (@andreynering)
• 6785e86: chore: merge main into crushrc (@meowgorithm)
• 15d2e1a: chore: regen golden files (@taciturnaxolotl)
• 35d82d0: chore: regenerate swagger docs (@taciturnaxolotl)
• 92d6998: refactor(shell): unify jq into the builtin registry (@taciturnaxolotl)
• 5d082a1: refactor(shellconfig): collapse option type system into one table (@taciturnaxolotl)
• 7303e15: refactor(shellconfig): replace copy-pasted flag loops with declarative engine (@taciturnaxolotl)
• 2a89bca: refactor(shellconfig): unify flagInt/flagInt64, make boolTrue a flagKind, checked assertions (@taciturnaxolotl)
• 6a6b215: refactor: build shell config imperatively instead of via JSON fragments (@meowgorithm)
• d8e0e73: refactor: make list option keys singular (@meowgorithm)
• 84f5b9c: refactor: make permissions deny the only tool-blocking command (@meowgorithm)
• 3e176af: refactor: rename provider/model unset to remove (alias rm) (@meowgorithm)
• 380c219: refactor: simplify shell config option booleans (@meowgorithm)
• 6c043eb: refactor: unify notification config under a single notifications key (@meowgorithm)
• 196dcf6: refactor: use positional provider ID for provider-model, rename options to option (@meowgorithm)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.88.0

Compare

Choose a tag to compare

MCP OAuth, performance and more

Happy Friday everybody!

We're releasing some nice features for you so you can enjoy your weekend vibecoding. (Or not, stay outside 🌞 and return to Crush on Monday! 😃).

MCP OAuth

That's it, it's finally here! Some of you have been asking for this for long.

This is required for some MCPs to work. Want to know to it set it up? Refer to this section into the README.

Thank @joestump and his agent @joestump-agent for this contribution. And of course, our favorite @taciturnaxolotl also helped.

Claude Channels MCP extension

@joestump (and his agent) also added an initial implementation to support the Claude Channels MCP extension, which means MCPs can now send notifications to Crush when certain events happen.

Give this a try if you're interested, and let us know how well it works for you.

Restored MCP prompts

MCP prompts were unintentionally disabled in a previous release, but they were now added back!

LSP performance boost

Another cool contrib was made by @TheJhyeFactor, who vastly improved the CPU and memory usage on handling LSP servers in large repositories!

See #3370 for a more in-depth explanation of the optimizations.

Bang mode performance boost

@TheJhyeFactor also improved performance of output streaming when running command in bang mode.

Check #3381 to see some benchmarking.

/etc/crush/crush.json

You read it right! Thank to @Muttaqin86 you can now have a system-wide Crush configuration on /etc/crush/crush.json.

The motivation for this was improving compatibility with NixOS.

Fixed Copilot + GPT-5.6

All three GPT-5.6 models (Sol, Terra and Luna) are now fixed when running via GitHub Copilot. Kudos to @nghiant03 for this!

That was a lot, but it's really fun to how much the community is enganged with Crush dev.

Keep Crushing! ™️
Charm

Changelog

New!

• 6f8a7fe: feat(client): reconnect the event stream after it drops (@meowgorithm)
• d291d9f: feat(cmd): add --channels opt-in flag for MCP channel servers (@joestump)
• 37fc995: feat(mcp): OAuth 2.1 authorization for HTTP MCP servers (@taciturnaxolotl)
• 1588ae8: feat(mcp): SSE OAuth, metadata fixups, and resource param stripping (@taciturnaxolotl)
• d338af8: feat(mcp): add OAuth support for HTTP MCP servers (@joestump)
• a1cf002: feat(mcp): detect claude/channel capability and receive channel messages (@joestump)
• b238696: feat(ui): tell a lost connection apart from an uninitialized agent (@meowgorithm)

Fixed

• fbf5934: fix(agent): close dispatch completion-boundary cancel race (@joestump-agent)
• ae9257b: fix(agent): serialize in-process run dispatch to prevent concurrent turns (@joestump)
• a09cb36: fix(backend): log channel flag mismatch on duplicate workspace creation (@joestump-agent)
• 086dc62: fix(client): add MCP prompts to ui in client-server mode (@meowgorithm)
• ca9ef6a: fix(cmd): make --channels a persistent flag so crush run inherits it (@joestump-agent)
• 213ad79: fix(config): load system-wide config from /etc/crush/crush.json (#2984) (@Muttaqin86)
• 8ccf694: fix(copilot): add additional responses models (#3416) (@nghiant03)
• 26399fc: fix(mcp): address OAuth review findings (timeout, refresh, concurrency) (@joestump-agent)
• bc8ff34: fix(mcp): buffer channel notifications during capability negotiation (@joestump-agent)
• 1f623ec: fix(mcp): filter channel events from the shared app event stream (@joestump-agent)
• 14fa1de: fix(mcp): prevent clients from inheriting channel opt-ins (@meowgorithm)
• 533fcf1: fix(mcp): prevent panic when auth signal fires twice (#3403) (@meowgorithm)
• f7c53cb: fix(mcp): route channel messages through must-deliver broker path (@joestump-agent)
• fed86b0: fix(mcp): tighten channel meta key validation for XML name safety (@joestump-agent)
• fd55b5d: fix(server): don't shut down while a workspace is being created (@meowgorithm)
• 2cb0bdb: fix(server): stop mapping channel events to spurious state changes (@joestump-agent)
• fa6ec09: fix(server): wait before shutting down so back-to-back sessions don't race it (@meowgorithm)
• 00a1843: fix(test): fix nil pointer crash in Windows CI tests (@meowgorithm)
• 1b4ef73: fix(ui): keep shell progress output from corrupting the TUI (@taciturnaxolotl)

Docs

• 7946b21: docs(mcp): add OAuth configuration guide and regenerate schema (@taciturnaxolotl)

Other stuff

• 2af939d: chore(cli): hide --channels (@meowgorithm)
• 1ba4dc4: chore(mcp): merge main; fix createTransport arity; inject browser opener (@joestump-agent)
• d2c6648: chore: auto-update files (@charmcli)
• b647ccd: chore: auto-update files (@charmcli)
• cba1ebc: chore: auto-update files (@charmcli)
• cc971bd: perf(lsp): filter servers before searching $PATH (#3370) (@TheJhyeFactor)
• e4175c5: perf(ui): avoid quadratic shell output rendering (#3381) (@TheJhyeFactor)
• 67e748e: revert: remove #3348 OAuth implementation (superseded) (@taciturnaxolotl)
• 1dad49c: style: gofmt formatting cleanup (@joestump-agent)

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.87.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.87.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.87.0

Compare

Choose a tag to compare