v0.95.0

Crux v0.95.0

This release introduces major advancements to remote client/server workspaces, including multi-owner architecture and remote project creation. It also completes the migration to the v2 peer-channel protocol, resolves critical error-swallowing behaviors, and hardens filesystem and authentication persistence against race conditions.

Multi-Owner Remote Workspaces

• Shared Workspace Authority: Remote workspaces now support multi-owner client runtimes (mergeClientRuntimeProposals). The primary owner controls workspace-wide settings (Models, Controls, Images, Codebase Index), while secondary owners can contribute their own distinct provider credentials and definitions to the shared session.
• Ownership Fencing: Enforced strict ownership validation (ownerOf) for remote patch proposals. Connected clients can only modify or replace credentials they own, preventing cross-client credential tampering in a shared remote session.

Remote Workspace Creation and Server Menu UI

• Remote Project Creation: Implemented native peer-channel APIs (menu.workspace.create) to browse, initialize, and clone projects on the remote server directly from the client.
• Creation Modes: Supports plain (empty directory), git-init, and git-clone modes with live progress streaming (menu.workspace.create_progress) back to the client UI.
• Server Menu Interface: Introduced a dedicated peer/server menu dialog (internal/ui/dialog/server_menu.go) to manage and list remote workspaces dynamically (menu.workspace.list, menu.workspace.list_changed).

Remote Client/Server Architecture and Reliability

• V2 Peer-Channel Protocol Migration: Completely restructured workspace and peer channel handling (new internal/proto/peer_channel.go and workspace_channel.go on both client and server) for robust remote connections, closing out the final gaps in the legacy v1 to v2 test and protocol migration.
• Transparent State Recovery: Dropped runtime-transaction acknowledgements are now transparently recovered by the v2 client via reconnect and authority-state reconciliation, replacing legacy manual recovery prompts.
• Client Authority and Provider Switches: Ensures client authority is preserved across remote provider switches. The selected client account and provider identity are published correctly before rebuilding remote agents, and switch failures are correctly retained instead of silently continuing with the previous provider.
• Remote Workspace Reattachment: Fixed a reconnect loop flaw where a remote connection lost and recovered under a new ID would fail to re-attach on an already-open peer connection, preventing a tight, permanent retry loop that previously caused remote sessions to hang.
• Stable Account Selection During Remote Collection: Remote runtime collection now snapshots which OAuth account is active for each selected provider before resolving credentials, then re-verifies that snapshot afterward. If the user's active account selection changes mid-collection, the collection now fails loudly instead of silently publishing a runtime built from a stale or mismatched account.

Error Visibility and Diagnostics

• Precise OAuth Refresh Failures: Threaded the real, non-secret server rejection reason for owning-client OAuth refresh completions end-to-end. Previously, the server genericized failures into a hardcoded string, making remote provider issues look like silent hangs. The server now returns distinct, specific reasons (e.g., stale revision, mismatched account, mismatched/unchanged credential).
• Agent Error Delivery: Fixed a UI issue where pre-generation agent errors (such as provider construction or initial auth failures) were silently dropped. These errors now properly reach the /errors view and UI toast notifications.

Security and Persistence

• Traffic Capture Hardening (TOCTOU Mitigation): Prevented executable validation races by verifying executable permissions on the exact file descriptor used to bind traffic-capture approval, so path-replacement attacks cannot substitute an unchecked target. As defense in depth, the approved executable is now copied byte-for-byte into a private, locked-down runtime location immediately after approval and launched from there, so the binary cannot be swapped out between approval and launch either.
• Write-Tool Target Binding (TOCTOU Mitigation): write, edit, multiedit, and lsp_replace_symbol now resolve and hold an open handle on the target's real ancestor directory before writing, closing the same class of check-to-open path-replacement race already fixed for traffic capture.
• Authentication and Filesystem Hardening: OAuth token lineage journals now identify credentials and file inputs with per-installation, secret-derived digests instead of plain content hashes, with automatic, verified migration of existing journals from the older format. Improved durability and safety for authentication journaling and file write targets, and hardened local data handling to fix runtime regressions in file access.

Validation and Maintenance

• Cross-Platform Test Reliability: Enhanced test reliability on macOS arm64 and Windows, including preventing Windows authorization tests from racing store reads and supporting Windows retained-directory security tests.
• Event Synchronization: Fixed race conditions in message event tests to ensure they wait for setup delivery.
• Remote Recovery Test Determinism: Fixed intermittent CI-only flakes in remote client/server tests: a context-cancellation subscription test that could close its event stream before subscribers observed it, cleanup-ordering bugs in multi-owner workspace teardown tests, and a client-authentication-recovery test whose readiness check could race the shell-based credential resolver used in the test fixture.
• Test Teardown Races: Fixed two intermittent "directory not empty" test failures caused by background work that could still be writing to disk after its corresponding shutdown call had already returned: the codebase-index reconcile goroutine now joins in-flight work when its lifecycle stops, and the embedded-ripgrep cache directory is now resolved once at process startup instead of being re-read lazily and racing per-test HOME overrides.
• Compatibility Protocol Test Stability: Fixed a background relay goroutine in a compatibility-protocol test that could panic the entire test binary by writing to a closing connection after its own test had already completed.
• Client-Authentication Test Teardown: Fixed an intermittent client-authentication-review test failure where the backend's default 10-second detach grace could tear a test workspace down mid-recovery, turning a slow-but-successful redial into a permanent failure.
• Config Test Suite CI Time: Cut real wall-clock time for OAuth token-refresh completion and lock-contention tests from over a minute to milliseconds by making the production timeout values overridable in tests, without changing production behavior or timeout durations.
• Manual Quality Checks: Added support for explicit manual quality and security checks.

Every test fix above was validated with a full, sequential go test pass across the whole repository, both with and without the race detector, with zero failures and zero data races.

Crux remains independently maintained and unaffiliated with the vendors whose provider protocols or command contracts it supports. Required upstream and third-party license notices remain included.

v0.94.1

Crux v0.94.1

This patch release improves provider switching, secures filesystem-backed tools, refines thought and todo presentation, and resolves cross-platform test regressions.

Provider and runtime reliability

• Fixes provider switching failures that could occur after a session had been running for an extended period.
• Improves publication of authentication and runtime state during provider changes.
• Prevents stale account, model, and configuration state from overriding newer selections.
• Improves OAuth credential loading and remote codebase-index authentication.
• Coordinates semantic API requests through credential-scoped rate limits to reduce failures during concurrent indexing and search operations.

Filesystem and image-generation security

• Binds approved jq and image-generation inputs to their captured filesystem identities.
• Uses descriptor-relative file access to prevent approved paths from being redirected through directory replacement or symlink races.
• Ensures queued image jobs retain authorized input and output directory handles throughout execution.
• Strengthens generated-image staging, replacement, cancellation, and cleanup behavior.
• Preserves existing outputs when image replacement fails.
• Adds Windows-specific retained-handle coverage without weakening the production filesystem security boundary.

Terminal interface

• Refines thought sections with clean framing and standard terminal backgrounds.
• Thought groups now default to collapsed, while single thoughts remain directly readable without unnecessary expansion controls.
• Corrects thought alignment, including when another message is selected.
• Removes unwanted spacing between thoughts and the following assistant response.
• Restores the standard background between the expanded todo panel and chat input.
• Removes the unintended background band above the todo panel.
• Improves instructions-dialog rendering and navigation edge cases.

Indexing, memory, and agent reliability

• Prevents superseded indexing workers from publishing stale state.
• Improves codebase-index request recovery and authentication handling.
• Strengthens background memory maintenance and bounded scanning.
• Improves agent compaction and summary behavior.
• Fixes configuration persistence and runtime-control regressions.
• Expands race-sensitive WebSocket and account-state coverage.

Embedded runtime and maintenance

• Refreshes embedded mitmproxy dependencies and platform lock files.
• Improves reproducible embedded-runtime packaging and licensing metadata.
• Adds manual dispatch support for build, lint, security, and generated-file workflows.
• Fixes Windows filesystem-security tests to account for valid handle-sharing restrictions.

Validation

The code changes in this release passed the full race-enabled test suite on Linux, macOS, and Windows, along with lint, security, and generated-file consistency checks in GitHub Actions. Focused filesystem-security tests and their owning packages also passed locally under the race detector on macOS.

No configuration migration is required for this patch release.

Crux remains independently maintained and unaffiliated with the vendors whose provider protocols or command contracts it supports. Required upstream and third-party license notices remain included.

v0.94.0

Crux v0.94.0

A large update to Crux's terminal interface, remote execution model, and agent runtime. This release refreshes the TUI layout and panels, lets a paired client run its own providers and accounts on a remote Crux server, adds a Queue/Steer delivery toggle, browser-authenticated fetching with explicit consent, Anthropic prompt caching, provider branding, a TUI preview server, and a durable authentication and pairing recovery model.

This release brings together the changes since v0.93.0. The remote workspace work is described in depth in the remote workspaces and pairing integration notes; this document summarizes it alongside everything else.

Terminal interface

• The chat, sidebar, input, dialogs, and notifications share a unified panel surface: the input and expandable panels use the chat background, code blocks use a distinct background, neutral panels share a palette, and secondary/selected text contrast is enforced by tests. Dark provider heading colors are raised in luminance for readability without changing stored brand colors.
• The sidebar is enabled by default, adapts its sections to the terminal height, and prioritizes Model/Context and files. Session now sits below Model/Context and shows the remote endpoint, a bold title, and a selectable short session ID that can be copied to the clipboard; unassigned sessions show no ID. The directory line has a padded light background, truncates at rest, and animates only while hovered. The sidebar opens adaptively after the first message in a new session and when continuing or resuming a session.
• Context occupancy in the sidebar and session protocol now includes unseen local tokens and compaction occupancy, so the displayed usage matches what the next request will carry.
• A new task panel (ctrl+t or ctrl+space to toggle, ctrl+down to hide and restore without losing state, Escape retains its existing behavior) lists background shells, agents, and image jobs with live output following, cached-output scrolling, restart, layered detail, and a terminal-style detail frame. Task notifications expand with Space or left click and copy their result and diagnostics together.
• Expanded tool results reveal long lines, keep source line numbers on the first visual row of code, fill wrapped diff rows, and preserve multiline error details. Search results are grouped and highlighted with expandable matches; skill loads separate metadata from instructions; directory summaries prioritize the tree and disclose the remainder.
• Summaries render as collapsible cards that preserve Unicode and tool errors. Blank thinking rows are skipped while a single non-blank thinking line remains visible.
• Long yes/no questions get a bounded editor layout, the instructions preview supports compact section navigation, the status bar uses extra terminal width for help, and the todo box fits its goals and floats above the input.
• Fixes terminal-width handling for initial and incremental frames, including wide and combined-character updates.
• Custom provider logos: labels of one to five characters use large block letters, six or seven use compact two-row lettering, and anything else renders as centered text.

Keyboard changes

Key	Action
alt+s	Toggle Queue/Steer delivery mode
ctrl+i	Open the codebase index dialog
ctrl+t / ctrl+space	Toggle the task panel
ctrl+down	Hide or restore the task panel
ctrl+b	Send a foreground-waited shell command to the background
shift+tab	Cancel plan mode at any stage

Queue and Steer

• Adds Queue/Steer message delivery, toggled with alt+s and persisted per project as tui.delivery_mode (default queue). Steer interrupts generation and running tools, keeps completed results, and waits only for in-progress summarization.
• Model changes made while a tool is running apply to the next model response.
• ctrl+b detaches a foreground-waited shell command to the background; background shells can be restarted under the same ID after they finish.

Remote workspaces: client-owned providers and pairing

New workspaces opened through a saved connection now execute with the client's selected providers, accounts, models, configuration, and plugin bundles. The server does not need those bundles installed, and a server-installed provider with the same ID cannot replace the accepted client definition. Server-owned workspaces remain available on request.

• crux --connection NAME opens the authenticated workspace menu and a bounded remote directory browser. Remote client runtimes load from the global client configuration, excluding the launch project's model settings, and honor explicit command-line model overrides.
• Clients call GET /v1/runtime-capabilities before submitting a private runtime proposal. Both peers must support runtime protocol version 1 and compiler identity crux-declarative-runtime-v23; older receivers are rejected explicitly with no fallback to server providers. Negotiation failures are reported by their actual HTTP cause.
• Provider, model, account, instruction, and runtime-control changes publish complete atomic revisions. Invalid or stale updates preserve the previously accepted runtime. The accepted runtime reaches main inference, title and memory requests, suggestions, summaries and compaction, image jobs, provider usage, and diagnostics.
• Client-owned codebase-index settings and credentials are forwarded through the runtime protocol, scoped by connection and remote project, with index paths resolved on the server and indexing workers bound to runtime ownership and lifetime.
• crux server setup uses a separate temporary enrollment listener (--enrollment-ttl, default ten minutes) with bounded admission and failure budgets. Authorization requires local y/yes approval on the server after reviewing the candidate's exact identity; possession of the setup code alone is insufficient.
• Interrupted pairing is recoverable: the client durably stages its pending identity before submitting, and connections pending, connections recover OPERATION_ID, and connections forget-pending OPERATION_ID --confirm-key-loss inspect, prove, and abandon retained identities.
• A verified client certificate owns each workspace; databases, saved sessions, and memory are certificate-scoped. The final-disconnect grace defaults to ten seconds, after which credential-bearing work is cancelled and joined.
• connections revoke NAME records the grant operation and asks running daemons to cancel and drain affected requests, workspaces, agents, and image jobs without restarting. connections authorized, connections revocations, abandon-revocation --confirm-unacknowledged, and audit-prune expose grant history and unresolved outcomes.
• The chat header and sidebar show accepted provider source, runtime revision, client fingerprint, and account identity. The Workspace Authority section is hidden unless debug is enabled.
• crux schema remote-runtime generates the private runtime schema; the regenerated OpenAPI is served under the authenticated /v1/docs/ route.

Authentication, accounts, and recovery

• API-key Check retains the exact checked input and Save reuses it without re-resolving or repeating the probe. Declared configuration credentials are separate selectable fields alongside a primary key or OAuth; saving one preserves the others and the model selection. Check reports the evidence it obtained rather than implying validation it did not perform.
• OAuth code, paste, callback, and device flows use owner-bound sessions. Completing browser authorization is followed by a durable save and publication transaction; retained results can be recovered without a second token exchange.
• Account listing, switching, removal, logout, and import act through the selected workspace's authority with explicit acknowledgements. Removing the active account selects the next stored account; removing the last clears the credential.
• New Review Saved Authentication (saved_auth, reload_auth) and Authentication History (auth_history) dialogs, plus accounts history, accounts repair-local, accounts pending-oauth, and accounts retire-oauth, expose redacted operation progress and explicit recovery or retirement for interrupted logins. Retirement never claims to undo earlier writes or revoke tokens at the provider.
• Automatic token refresh runs on the owning client, is bound to the exact principal, provider, account, and credential generation, and cannot revive removed or replaced accounts.
• Provider and MCP destination policies are enforced at dispatch as well as admission. Credential-bearing redirects stay bound to their selected origin, MCP traffic stays bound to the configured MCP origin, and a destination refusal cannot trigger another authentication attempt or clear a saved token.
• Private authentication journals are bounded to 128 records and 256 MiB per workspace; secrets are redacted with process-keyed fingerprints instead of retained plaintext, and redaction preserves embedded JSON structure without truncating IDs or hashes.

Agent tools and runtime

• Browser-authenticated fetch. fetch, agentic_fetch, and web_fetch accept mode: user, which copies cookies from a user-selected browser profile into memory and uses that browser's user agent. Every use requires explicit request or current-session consent even under automatic tool approval; denial never falls back to anonymous fetching, cookies are never written back, and cookie values are redacted from output. Image-generation providers can use the same consented browser identity.
• fetch now returns compact Markdown by default (5 MB input, bounded output) using an upgraded HTML-to-Markdown pipeline sha...

Crux v0.93.0

Crux v0.93.0

A substantial update to Crux's provider runtime, image generation, command-line compatibility, remote setup, and everyday agent tooling. This release moves legacy provider discovery to explicitly installed bundles, adds new ways to use Crux from existing automation, and strengthens the boundaries between selected providers, credentials, sessions, and background work.

Archive correction, September 5, 2026: The release archives were refreshed to include the compatibility guide, provider-plugin guide, preset catalog README, and Catwalk license omitted by the initial packaging rules. Executables and the v0.93.0 tag are unchanged. If you downloaded an earlier archive, download it again with the current checksums.txt.

Provider runtime and catalog migration

• Provider and model discovery now use Crux's Foundation runtime and trusted installed bundles instead of the legacy embedded or cached Catwalk catalog. Historical providers.json files are no longer loaded, and the old update-providers command is removed.
• Includes 26 individually installable provider presets migrated from Catwalk v0.51.23, covering providers such as DeepSeek, Groq, Fireworks, Hugging Face, Moonshot, OpenCode, Venice, xAI, and Z.AI. These are data-only catalogs for the existing OpenAI-compatible implementation, not executable plugins.
• Expands declarative provider integration across authentication, endpoints, request construction, response events, model controls, metadata, usage, images, and compatibility adapters. Installation checks the declared contract against the runtime that will execute it.
• Provider configuration, credentials, model selections, and in-flight operations remain bound to the exact registered owner. A missing, changed, disabled, or untrusted integration stays visibly unavailable instead of silently becoming a different provider or generic endpoint.
• Preserves selected provider/model values during temporary plugin unavailability and keeps auxiliary model calls attached to their selected provider.
• Fixes setup for anonymous plugins: a provider that declares no authentication no longer gets forced through API-key onboarding. Providers that require credentials retain their authentication checks.

Upgrading provider configuration

Keep existing trusted provider bundles installed when upgrading. Full protocol and OAuth integrations require their corresponding provider bundles; this release does not distribute private provider bundles, accounts, or credentials. Copilot remains core-owned.

For a migrated OpenAI-compatible provider, install its preset from the extracted release archive or repository checkout, then restart Crux. For example:

crux plugins install ./plugins/provider-presets/deepseek.plugin

Retain the API key or environment variable required by that provider. Do not recreate a preset-owned provider as an unrelated custom endpoint to bypass a missing integration. Providers needing a different protocol or identity flow are not automatically converted into OpenAI-compatible presets.

See the provider preset catalog and provider plugin documentation for the supported bundles, installation contract, and migration details.

Image generation and editing

• Adds image generation and editing through the crux imagegen command and native imagegen tool, backed by separately installed declarative image-provider bundles.
• Image jobs run in the managed background worker pool and report completion back to the originating conversation.
• Supports provider-declared models, sizes, quality, transparency, input images, and multiple output variants.
• Captures the selected provider owner before permission approval and retains it throughout execution. A missing or replaced provider is not silently substituted.
• Adds collision-safe output allocation, explicit overwrite handling, input/output path authorization, persistent upload tracking, and preservation of successful variants when another variant fails.
• Publishes a dedicated image-provider schema alongside the configuration, provider-plugin, and provider-preset schemas.

Image generation requires a compatible installed image provider and its authentication. Backend-specific capabilities and availability come from that bundle; the standard release does not include private image-provider bundles or guarantee access to a particular service.

CLI compatibility for existing automation

Experimental and not well tested. Verify the compatibility layer with your own workflows before relying on it.

• Adds built-in, unofficial adapters for the codex, claude, agy, and copilot command contracts while keeping normal crux invocation unchanged.
• Supports translated prompt entrypoints, session operations, model selection, permission controls, and text or machine-readable output where defined by each adapter.
• Adds native-backed protocol surfaces including Codex app-server stdio, Claude stream JSON and SDK WebSocket, Antigravity stream JSON, and Copilot ACP/SDK stdio.
• Provides an explicit, reversible local alias installer with status, enable/disable, repair, and removal operations. Existing official executables are not overwritten.
• Documents accepted no-op flags and unsupported administrative operations rather than claiming complete equivalence with vendor tools.

The adapters are included in the Crux executable. The separate crux-compat alias manager is built from the checkout and is not included as a second executable in the standard release archives. See the compatibility guide before using the aliases in automation, especially when relying on sandbox, budget, or permission flags.

Remote setup and workspace management

• Adds crux server setup and crux connections pair for a guided, one-time enrollment flow. Setup codes carry a short-lived registration token and server-certificate fingerprint; client and server private keys remain on their originating machines.
• Adds managed Linux user-service installation and lifecycle commands, with foreground setup for environments without supported service management. The explicit offline pairing flow remains available.
• Improves the remote workspace menu with active/idle workspaces, bounded directory browsing, configured-root navigation, filtering, refresh, and return-to-menu behavior after a graceful workspace exit.
• Keeps remote filesystem access within configured roots and forwards selected provider state through the authenticated connection without persisting forwarded credentials on the server.
• Fixes workspace initialization when connecting to a server on another host.

Agent tools, diagnostics, and indexing

• Adds a native jq tool that shares the embedded shell's JSON-query implementation without requiring an external jq executable.
• Unifies file-path and file-content discovery under the search tool, with explicit search modes and bundled ripgrep on supported platforms.
• Adds bounded traffic-record detail and body-search tools for local HTTP and WebSocket diagnostics, so inspecting one request does not require loading an entire capture.
• Adds optional isolated HTTPS traffic capture with a local authenticated viewer. Capture requires explicit approval because decrypted traffic can contain credentials and private data.
• Improves semantic-index storage cleanup and recovery while preserving usable index state.
• Strengthens scoped memory and active-skill synchronization so the available tools and instructions reflect the current session configuration.

Traffic capture is an optional source-build feature. Build with ./build.sh --build --embedded-mitmproxy to include its runtime on supported targets. Standard release archives are untagged builds and do not contain the embedded mitmproxy runtime; they do not fall back to installing or running host Python for capture.

Known optional-runtime security issues: The capture runtime pins Tornado 6.5.5, MessagePack 1.1.2, h2 4.3.0, and cryptography 48.0.1, which have published security advisories. Fixed dependency versions fall outside the latest published mitmproxy 12.2.3 constraints, so this release retains the existing pins rather than silently overriding them. Optional capture builds remain affected; the standard release archives do not include these Python dependencies. Do not treat the optional runtime as security-cleared by this release.

Session, background-task, and UI reliability

• Tightens permission handling across normal turns, background agents, continuations, and compatibility execution.
• Improves background-task lifecycle handling, output routing, and presentation, including image jobs. Closed task stores consistently reject further operations, including on Windows, so failed persistence releases reserved task capacity.
• Strengthens plan-mode execution boundaries and completion handling.
• Improves streaming retry presentation, conversation-summary handling, and model/provider selection behavior.
• Preserves queued follow-up input when canceling, keeps task notifications out of prompt-input history, and improves rewind and modified-file behavior.
• Improves dialog/button interaction, responsive layout, and provider-themed UI presentation.

Build, packaging, and security fixes

• Fixes native builds under macOS's system Bash when no optional build tags are selected. Build, test, and check modes retain their exit-status behavior.
• Adds an explicit Rosetta-based macOS x86_64 build-and-verification mode for Apple Silicon source builds.
• Updates golang.org/x/crypto to v0.56.0 to address the reported SSH connection-deadlock advisories.
• Improves response-body cleanup, streaming resource ownership, and cancellation-context pro...

v0.92.1

Changelog

• e8caf9c: feat: add secure remote workspace operations (@example-git)
• fc7a272: fix: honor nested remote workspace boundaries (@example-git)
• 385cf07: fix: keep API documentation in sync (@example-git)
• 18c3227: fix: keep background task state durable on Windows (@example-git)
• a6e7594: fix: keep opened directory labels independent of remote paths (@example-git)
• 7a0f7f5: fix: prevent remote workspace browsing from escaping trusted roots (@example-git)
• 9672a18: fix: release background task capacity before waking waiters (@example-git)
• dfcdb41: fix: select the working Python launcher on Windows (@example-git)

v0.92.0

Changelog

• d73a6e4: Revert "fix(bash): decide auto-approval from the parsed command, not its prefix" (@joestump)
• 877c539: feat: establish Crux as an independent coding harness (@example-git)
• 1fdb081: fix(bash): decide auto-approval from the parsed command, not its prefix (@joestump-agent)
• 059ba81: fix(bash): keep read-only git filter and remote forms auto-approved (@joestump-agent)
• 07e0544: fix(bash): satisfy staticcheck QF1001 in isAssignment (@joestump-agent)
• ed15da4: fix(ui): use dialog background for bash syntax highlighting in permissions (charmbracelet#3575) (@andreynering)
• 8dd773b: fix: harden filesystem access and cross-platform validation (@example-git)
• d77c80f: fix: tighten filesystem and local server security (@example-git)
• 945c518: sec(bash): close four auto-approval gaps in the safe-command matcher (@joestump)