Crush v0.100.0

Subagents, Sysadmin Mode, and PGP/SSH Prompts

This is a big one! Crush can now run a team of subagents, permissions are much more flexible, and you can now do GPG and SSH auth right inside Crush! Read on for more.

👩🏼‍🐰‍👩🏽 Subagents

At last, subagents. Crush can now spawn a little team of friendly subagents in the background, as well as check on them, send them mid-run follow-ups, stop them, or move them to a different model.

You can watch them work right in the transcript, sidebar and header. Every subagent gets its own name, too, so you always know who's doing what. And, if you refer to them by name, Crush will know which of ’em you’re talking about!

🚨 Sysadmin Mode

Ever wish Crush could DROP SCHEMA public CASCADE;? Now it can, with Sysadmin mode! In fact, in Sysadmin mode, Crush can run any command on your system. Be careful.

Find Sysadmin mode in the command palette (ctrl+p) or toggle through all modes with shift+tab.

🙅🏻‍♀️ Safe Commands

Of course, Yolo Mode still blocks dangerous commands, but now which commands are dangerous is up to you.

• permissions safe marks commands safe for yolo
• permissions block blocks commands completely
• permissions unblock unblocks restricted commands

# Building is fine
permissions safe "go build" "cargo check"

# Don't touch my infra please
permissions block kubectl terraform

# Curl your heart out
permissions unblock curl

🗝️ PGP and SSH

It’s so annoying when you’re using an AI agent and can’t enter an SSH password, activate your Yubikey and enter GPG passwords, eh? Well, with Crush, that annoyance is a thing of the past.

No more compromising your security to when usin’ AI!

There’s tons more stuff in the changelog below, too.

This is one of our biggest releases, and we're so grateful for your support!

Have a great day, The Charm Team ⭐

Changelog

New!

• 965d1a794bbe5c01c2f0e5b62293791060d81622: feat(agent): dispatch detached sub-agents and message them mid-run (@taciturnaxolotl)
• 938fef205ca1ba6a35d5ff9f93e69b5c31d41a83: feat(agent): let agent_send move a subagent to a different model (@taciturnaxolotl)
• f7179d1624643b84fb350528c85d86407541ac6e: feat(bash): judge a chain of read-only commands by its parts (@taciturnaxolotl)
• 46c7bc4a65a2c3553b35eed7e4916871e9df3760: feat(config): let a project configure the commands it runs all day (@taciturnaxolotl)
• 4efcd2c345fe9b7d5462d73bfd6e40dde379c731: feat(message): carry a sub-agent report as its own message part (@taciturnaxolotl)
• 44cb8e3a8aeb6d555ce9de3886c3efdd76ef01b5: feat(permissions): add sysadmin mode (@taciturnaxolotl)
• 526da24eceeba1ab4516d2da7d0ccf6faf96636c: feat(permissions): make the dangerous-command list configurable (@taciturnaxolotl)
• c42442d94b304a64ca208d819dee9894188815bf: feat(permissions): stop asking about dangerous commands in yolo mode (@taciturnaxolotl)
• d4430bcce9c80d0f71f1a96dba921db85110bac4: feat(subagents): give each subagent its name for real, not just on screen (@taciturnaxolotl)
• d11509b7899a720852899afc55211088aa4c1272: feat(subagents): shuffle first names, accent them, and set them apart on screen (@taciturnaxolotl)
• c55f231c328a047a1710574ab32d677e368a87de: feat(ui): calmer subagent messages and a readable status (@taciturnaxolotl)
• e498ee2a4557623594ccc837b3678c97a2994639: feat(ui): make a dangerous permission prompt harder to approve by reflex (@taciturnaxolotl)
• 573e1fb2442d7ae41fdd75ff147e34a8c981f1a6: feat(ui): name subagent actions for what they do (@taciturnaxolotl)
• ae4f92c5f3cb56f57177b1e4b4efd649e65b7fb3: feat(ui): polish how sub-agents read in the transcript (@taciturnaxolotl)
• 99104438bccddf50f03907b0115346cfe4d7c0c9: feat(ui): put sysadmin mode in the Shift+Tab cycle (@taciturnaxolotl)
• 36bf1011bf6d5e3e99ca176b2065f563f666a524: feat(ui): render queued subagent reports compactly and give attachments room (@taciturnaxolotl)
• 49e77237920ca10df5a33b2b334bc9cb88e106c7: feat(ui): show sub-agent progress in the transcript, header, and quit dialog (@taciturnaxolotl)
• 16b7ee1e03157066766b068f5c23a846e6c2eb9e: feat: custom SSH password handling (#3883) (@andrinoff)
• a5a7820b5793ede9258295fa321eae3ed8c58eff: feat: custom pinentry in crush (#3773) (@andrinoff)

Fixed

• 77a65f0b79e355d3401e2c02f7aaa0c2fea2dfa0: fix(agent): end the turn while subagents work instead of polling for their reports (@taciturnaxolotl)
• 92d5877f3ab396fed8245e2d0916bce54b4487bc: fix(agent): queue a subagent report until the model reads it, behind the user's own messages (@taciturnaxolotl)
• 280ea8950715ce73dc833827085f65689675aaea: fix(agent): stop title generation from outliving its run (@taciturnaxolotl)
• 9345eef3e8f87c2e5b2449c0d80964abb59e0be4: fix(agent): surface truncated and provider-stopped responses (#4233) (@andreynering)
• 13b478156ae6534664cac5efa32e35456a80c29e: fix(agent): tell the parent why a subagent stopped without a report (@taciturnaxolotl)
• b18531d6b0971f36d443d2569fb453cd61cfd090: fix(agent): use routed model pricing for Prism session costs (#4236) (@andreynering)
• 53aa4dabb5429330e789bb96b72397adcca2175e: fix(auth): share one AWS SSO login and let a cancelled request stop waiting (@taciturnaxolotl)
• d3b899755b559db323a69adcfbdd6a6a70cc07dc: fix(bash): decide auto-approval from the parsed command, not its prefix (@joestump)
• 7f1500e8446a6a8feaef00059d905bdc1f9dcf9e: fix(bash): reject backslash escapes in literal words (@joestump)
• 15c37e355ff087de191efc6d3135ffd8fe4d334f: fix(bash): stop an unreadable command from waiving checks for its neighbours (@taciturnaxolotl)
• dc2543b268ef17b18566b6694d76bf3438caed76: fix(config): drop reasoning options a model cannot use when switching to it (@taciturnaxolotl)
• 1662cbd93c7afd1499eac2d526b1a850264efddc: fix(db): keep sub-agent prompts out of the prompt history (@taciturnaxolotl)
• b9f30dd685ace0b1e228c92d34df9772ceb60212: fix(permissions): harden the dangerous-command check (@taciturnaxolotl)
• fd40067edd69b383f6c960b57abed20cc5cdb1a7: fix(permissions): scope a session approval to what was actually approved (@taciturnaxolotl)
• 2000857de44a258a514dd448829bff0c317c2af1: fix(pubsub): keep only the newest pending update per message for slow subscribers (#4184) (@taciturnaxolotl)
• 21e09ebf05ac8612070e0f54daabce3d2de5c0c9: fix(server): don't show an error for diagnostics (#4216) (@andrinoff)
• 95d807ac8a36de0f287a2952f6d7b2e3ac057925: fix(server): report the permission mode the server is actually enforcing (@taciturnaxolotl)
• ac2ce4a16968945f91e34dd6e26cb2fcc9502c37: fix(shell): apply the command block list to scripts and builtins (@taciturnaxolotl)
• f88e14708621fa5949224fb7266ede9bf8a44097: fix(shell): cap the output a command keeps in memory (#4183) (@taciturnaxolotl)
• 769058152764af791114897843c99ad7961eea69: fix(shell): detect command chaining by parsing, not string matching (@taciturnaxolotl)
• 963a60071f0cf2cc0b9c4d0114758295d2356e12: fix(shell): harden command blocking against common evasions (@taciturnaxolotl)
• ab1125f9bde04acbf9695a156381f14142be4a29: fix(shell): match dangerous commands regardless of case (@taciturnaxolotl)
• 5951fe1892fb6dc837e9f806de79126e3f547551: fix(shell): say what is dangerous in plain words (@taciturnaxolotl)
• 8a3ff03d93caa36649d17770c4fdfcd2ac4bbc2d: fix(ssh): let sshpass and other terminal drivers answer ssh prompts (@taciturnaxolotl)
• 9c32a1898e2e15add4aaf36d60a11f15924bdeeb: fix(subagents): always give a new subagent its own first name (@taciturnaxolotl)
• ad2d695b8c4cc5d3038817c9b3798bc4439fe21e: fix(subagents): check status without formatting a subagent's whole history (@taciturnaxolotl)
• 19c626dd41e014397582d79c561bec6870b1ab47: fix(subagents): forget finished subagents past a small cap (@taciturnaxolotl)
• b7008c623ffbed268415481599d5a13a5ea66c02: fix(subagents): keep a subagent's report when the turn it was waiting on is cancelled (@taciturnaxolotl)
• ee9a0e353705a49520f91508fad44ca01e04bf0c: fix(subagents): read the parent model without racing the agent build (@taciturnaxolotl)

…