It’s Time for a Bugfix Throwdown

This release is all about stability and quality of life with a buncha fixes around MCP, server-client, and odds and ends. Here's what’s inside:

UX: Typing clear in the command will match Summarize; thanks, @joestump!
LSP: @piakdev fixed a case where LSP could panic
MCP: Slow loading MCPs could block messages from being sent: we reduce default timeout
Server-Client: MCP OAuth didn't work in server-client mode; now it does
Server-Client: Clients in the same workspace could kill each other: not anymore
Server-Client: When the server is running over TCP keystrokes no longer hit the server and slow everything down
Hyper: Added various small improvements for better UX

Thanks for using Crush. Have good weekend! Charm 💌

Changelog

New!

cfad8143fc0414d1406a8b846708a43ee511a757: feat(dialog): alias clear to summarize in command palette (#3464) (@joestump)

Fixed

bdad0f11cd6a279548c9458349fec313cbbea4fb: fixmcp): don't hold callback port open permanently (#3481) (@taciturnaxolotl)
1134a5ddb8e762aa85452df12a98c17172ec189b: fix(dialog): raise permission-guard quiet period to survive natural typing pauses (#3393) (@albatrossflyon-coder)
768ffad29a49fcd4a63792fab057b2246e213622: fix(hyper): keep working cache when provider cache can't be written (@meowgorithm)
9efc08c7aeb6f46c3a5d260115856b610df187aa: fix(hyper): render error messages from back-end (#3513) (@andreynering)
42f3ce0cbea37e37cd4ef6bd3d83e1dab0401403: fix(lsp): handle window/workDoneProgress/create to prevent server crash (#3445) (@piakdev)
604a7e30e624ecbe5969d288c58ad1b092ac8917: fix(providers): swap the provider cache instead of rewriting it (@meowgorithm)
85d83ce4e2308e3d45298eacdeb1d6943a286cb4: fix(server): keep concurrent sessions from killing each other (@meowgorithm)
ebd18571086389396004118a6680408d7ca87356: fix(server): mcp auth in client-server mode (@meowgorithm)
71fa577a7d40bc529d90c1ca0263e57f6170c1ed: fix(server): release test DB before Windows temp-dir cleanup (@meowgorithm)
390ee36122ded4bd60f412e47cf5383719355a84: fix(server): replace stale servers that predate shutdown_if_idle (@meowgorithm)
7cdef9e6ee69634dcbc694d9096b65fef2a092e7: fix(server): typing lag over TCP in client/server mode (@meowgorithm)
cf4f4df3216cc0c5948241e4aac2cf7968e26e8a: fix(server): widen permission cross-client test timeout to stop CI flake (@meowgorithm)
69080c969ef16ec64127732a8c2deab4270807bf: fix(workspace): retire integration-test clients so the DB closes (@meowgorithm)
8fd69b4548a01606ae6d49bc9202b3be75904acb: fix(workspace): wait for recovery notice before asserting resync (@meowgorithm)
bb3d44954d4769c6f66c960df89e0f1b8d3f4777: fix: reduce default and suggested mcp timeout (#3509) (@andreynering)

Docs

5f11f8e28aa7c757cfb7b54483b0b6654a64f776: docs(agents): mark crushrc as primary config format over crush.json (@meowgorithm)
d99076e5ce59a73c8c3d21f8a3bd52bf4691c94d: docs: add missing OAuth flags to mcp add in crush-config skill (@pshickeydev)

Other stuff

97ac1544991c1fc572fd3db7703f99db93dc3049: chore(mcp,ui): make 'needs auth' color tang, consolidate theme naming (@meowgorithm)
9882a88a2d668818047c445cc2e6fd4d7a7e2ea4: hyper: hide hypercredits if the server sends USD as the monetary unit (@meowgorithm)
fb0f6c5808ea869e8b5f79a9b28248884fadf30c: refactor(server): tidy mcp client-server auth wiring (@taciturnaxolotl)
b109e35f260cbb6a7903581728dbeb6d11895d57: refactor(ui): route all agent-model rebuilds through one helper (@taciturnaxolotl)

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.1/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.1/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.