v0.98.2

Keanu, OAuth re-sign-in and a crash fix

This patch was brought to you by our team and our favorite contributors!

The Keanu Theme

Caution

This will make you feel like a hacker

A theme made by @andreynering 🎉 💻

Fixed!

• Fixed a crash when parallel tool calls finish together, by @andreynering
• Fixed OAuth sign-in and credential refresh, by @taciturnaxolotl
• Ctrl+C now interrupts startup, and custom provider model discovery no longer stalls it, by @taciturnaxolotl
• Fixed server prompts and permission requests being scoped to the wrong session, by @meowgorithm
• Fixed the TUI status, spinner and tool-header display, by @taciturnaxolotl

Good luck, Charm XX

Changelog

New!

• cd5f15d: feat(openrouter): send app attribution headers and session_id for sticky routing (#4115) (@Lee-Si-Yoon)
• a8a8ec8: feat: add a built-in keanu theme (#3955) (@andreynering)
• 78b6edb: feat: publish optional signed Packslip release manifests (#4085) (@jdx)

Fixed

• 20e73b4: fix(agent): ask every OAuth sign-in to sign in again on a 401 (@taciturnaxolotl)
• 02336b1: fix(agent): give sub-agents the renewed credential after a refresh (@taciturnaxolotl)
• acbf1a7: fix(agent): prevent crash when parallel tool calls finish together (#4129) (@andreynering)
• a299286: fix(agent): publish run-complete when a run fails during setup (@taciturnaxolotl)
• ddf6f26: fix(auth): ask for a new sign-in whenever a provider rejects the credential (@taciturnaxolotl)
• e660fd9: fix(auth): stop retrying a refresh token the provider already refused (@taciturnaxolotl)
• 510f6ea: fix(bash): stop finished jobs from using up the background job budget (#3869) (@taciturnaxolotl)
• 8fa35a0: fix(ci): remove duplicate permissions block that broke the release workflow (@taciturnaxolotl)
• 94f9364: fix(ci): scope workflow token permissions to least privilege (@taciturnaxolotl)
• 00560ce: fix(lint): stop gofumpt versions fighting over the session pager return (#4088) (@taciturnaxolotl)
• b0f7811: fix(login): open the browser as a command so tests never launch it (#4071) (@taciturnaxolotl)
• 1dbd303: fix(tools): create parent dirs only after write permission is granted (@taciturnaxolotl)
• d65d685: fix(tools): drop empty images instead of failing the whole request (#3891) (@taciturnaxolotl)
• f530936: fix(tools): let the agent recover from failed web requests (#4086) (@andreynering)
• 6a12bc6: fix(ui): bring back the chat scrollbar's auto-hide (#4084) (@andreynering)
• 0b75089: fix(ui): end a turn when the agent says the run is over (@taciturnaxolotl)
• 12f96b4: fix(ui): give every status message its own time on screen (#3896) (@taciturnaxolotl)
• 6eb6910: fix(ui): keep the background flag colored in the bash tool header (@taciturnaxolotl)
• fdcc7a1: fix(ui): keep the question gutter bar unbroken when a choice wraps (@taciturnaxolotl)
• a48dabe: fix(ui): keep the terminal's done and error status from vanishing (#4046) (@taciturnaxolotl)
• c89ef9d: fix(ui): show grep search parameters in pending tool state (#2070) (@LarsArtmann)
• ddf6ccc: fix(ui): show the turn spinner from the moment a prompt is sent (@taciturnaxolotl)
• c446d3f: fix: grype (#4062) (@andrinoff)
• 17e428f: fix: let Ctrl+C interrupt Crush startup (@taciturnaxolotl)
• 1f5d7f0: fix: measure provider silence only (#4031) (@andrinoff)
• 623ba43: fix: never leave a tool call waiting for an answer that cannot come (@taciturnaxolotl)
• 17fccc0: fix: show which model answered Prism-routed session summaries (#4116) (@andreynering)

Docs

• 205e2fa: docs(install): note npm supports macOS, Linux, and Windows (#3195) (@truffle-dev)
• 7572704: docs: Updated hooks config from legacy crush.json syntax (#3956) (@KevinFumbles)
• f5aa293: docs: add missing XAI_API_KEY to environment variables table (#3291) (@albatrossflyon-coder)
• 646d2bc: docs: fix capitalization in the beginning sentence and word abbreviation (@afsuyadi)
• f68ddeb: docs: fix missing apostrophe (@afsuyadi)
• 3e0b0bf: docs: fix mistyped word in comment line (@afsuyadi)
• 2ecab34: docs: fix typos in README.md (#3816) (@cloudcodec)
• b46cd7a: docs: remove the free subscription (#4128) (@andrinoff)
• dd3018e: docs: replace gpt-4 in the Nix configuration example (@pcbeingused333)

Other stuff

• 37a60b5: Fix typo in data retention description (#3560) (@cobein27)
• 0c16d5f: chore: auto-update files (@charmcli)
• 7ba09f3: chore: auto-update files (@charmcli)
• 699ceeb: chore: auto-update files (@charmcli)
• c32b779: chore: gofumpt (@andreynering)
• 7dadde0: perf: stop custom provider model discovery from stalling startup (@taciturnaxolotl)
• 80374e7: server: broadcast prompt events that carry an empty session ID (@meowgorithm)
• f1425bd: server: fail open prompts for clients that never report a session (@meowgorithm)
• e890891: server: memoize root session resolution per workspace (@meowgorithm)
• 305e072: server: scope permission/question prompts to the current session (@meowgorithm)

---

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.98.2/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.98.2/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/charmbracelet/crush/\.github/workflows/(release|nightly)\.yml@' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.