v0.95.0

Crux v0.95.0

This release introduces major advancements to remote client/server workspaces, including multi-owner architecture and remote project creation. It also completes the migration to the v2 peer-channel protocol, resolves critical error-swallowing behaviors, and hardens filesystem and authentication persistence against race conditions.

Multi-Owner Remote Workspaces

• Shared Workspace Authority: Remote workspaces now support multi-owner client runtimes (mergeClientRuntimeProposals). The primary owner controls workspace-wide settings (Models, Controls, Images, Codebase Index), while secondary owners can contribute their own distinct provider credentials and definitions to the shared session.
• Ownership Fencing: Enforced strict ownership validation (ownerOf) for remote patch proposals. Connected clients can only modify or replace credentials they own, preventing cross-client credential tampering in a shared remote session.

Remote Workspace Creation and Server Menu UI

• Remote Project Creation: Implemented native peer-channel APIs (menu.workspace.create) to browse, initialize, and clone projects on the remote server directly from the client.
• Creation Modes: Supports plain (empty directory), git-init, and git-clone modes with live progress streaming (menu.workspace.create_progress) back to the client UI.
• Server Menu Interface: Introduced a dedicated peer/server menu dialog (internal/ui/dialog/server_menu.go) to manage and list remote workspaces dynamically (menu.workspace.list, menu.workspace.list_changed).

Remote Client/Server Architecture and Reliability

• V2 Peer-Channel Protocol Migration: Completely restructured workspace and peer channel handling (new internal/proto/peer_channel.go and workspace_channel.go on both client and server) for robust remote connections, closing out the final gaps in the legacy v1 to v2 test and protocol migration.
• Transparent State Recovery: Dropped runtime-transaction acknowledgements are now transparently recovered by the v2 client via reconnect and authority-state reconciliation, replacing legacy manual recovery prompts.
• Client Authority and Provider Switches: Ensures client authority is preserved across remote provider switches. The selected client account and provider identity are published correctly before rebuilding remote agents, and switch failures are correctly retained instead of silently continuing with the previous provider.
• Remote Workspace Reattachment: Fixed a reconnect loop flaw where a remote connection lost and recovered under a new ID would fail to re-attach on an already-open peer connection, preventing a tight, permanent retry loop that previously caused remote sessions to hang.
• Stable Account Selection During Remote Collection: Remote runtime collection now snapshots which OAuth account is active for each selected provider before resolving credentials, then re-verifies that snapshot afterward. If the user's active account selection changes mid-collection, the collection now fails loudly instead of silently publishing a runtime built from a stale or mismatched account.

Error Visibility and Diagnostics

• Precise OAuth Refresh Failures: Threaded the real, non-secret server rejection reason for owning-client OAuth refresh completions end-to-end. Previously, the server genericized failures into a hardcoded string, making remote provider issues look like silent hangs. The server now returns distinct, specific reasons (e.g., stale revision, mismatched account, mismatched/unchanged credential).
• Agent Error Delivery: Fixed a UI issue where pre-generation agent errors (such as provider construction or initial auth failures) were silently dropped. These errors now properly reach the /errors view and UI toast notifications.

Security and Persistence

• Traffic Capture Hardening (TOCTOU Mitigation): Prevented executable validation races by verifying executable permissions on the exact file descriptor used to bind traffic-capture approval, so path-replacement attacks cannot substitute an unchecked target. As defense in depth, the approved executable is now copied byte-for-byte into a private, locked-down runtime location immediately after approval and launched from there, so the binary cannot be swapped out between approval and launch either.
• Write-Tool Target Binding (TOCTOU Mitigation): write, edit, multiedit, and lsp_replace_symbol now resolve and hold an open handle on the target's real ancestor directory before writing, closing the same class of check-to-open path-replacement race already fixed for traffic capture.
• Authentication and Filesystem Hardening: OAuth token lineage journals now identify credentials and file inputs with per-installation, secret-derived digests instead of plain content hashes, with automatic, verified migration of existing journals from the older format. Improved durability and safety for authentication journaling and file write targets, and hardened local data handling to fix runtime regressions in file access.

Validation and Maintenance

• Cross-Platform Test Reliability: Enhanced test reliability on macOS arm64 and Windows, including preventing Windows authorization tests from racing store reads and supporting Windows retained-directory security tests.
• Event Synchronization: Fixed race conditions in message event tests to ensure they wait for setup delivery.
• Remote Recovery Test Determinism: Fixed intermittent CI-only flakes in remote client/server tests: a context-cancellation subscription test that could close its event stream before subscribers observed it, cleanup-ordering bugs in multi-owner workspace teardown tests, and a client-authentication-recovery test whose readiness check could race the shell-based credential resolver used in the test fixture.
• Test Teardown Races: Fixed two intermittent "directory not empty" test failures caused by background work that could still be writing to disk after its corresponding shutdown call had already returned: the codebase-index reconcile goroutine now joins in-flight work when its lifecycle stops, and the embedded-ripgrep cache directory is now resolved once at process startup instead of being re-read lazily and racing per-test HOME overrides.
• Compatibility Protocol Test Stability: Fixed a background relay goroutine in a compatibility-protocol test that could panic the entire test binary by writing to a closing connection after its own test had already completed.
• Client-Authentication Test Teardown: Fixed an intermittent client-authentication-review test failure where the backend's default 10-second detach grace could tear a test workspace down mid-recovery, turning a slow-but-successful redial into a permanent failure.
• Config Test Suite CI Time: Cut real wall-clock time for OAuth token-refresh completion and lock-contention tests from over a minute to milliseconds by making the production timeout values overridable in tests, without changing production behavior or timeout durations.
• Manual Quality Checks: Added support for explicit manual quality and security checks.

Every test fix above was validated with a full, sequential go test pass across the whole repository, both with and without the race detector, with zero failures and zero data races.

Crux remains independently maintained and unaffiliated with the vendors whose provider protocols or command contracts it supports. Required upstream and third-party license notices remain included.