Crush v0.100.0 release notes

Subagents, Sysadmin Mode, and PGP/SSH Prompts

This is a big one! Crush can now run a team of subagents, permissions are much more flexible, and you can now do GPG and SSH auth right inside Crush! Read on for more.

👩🏼‍🐰‍👩🏽 Subagents

At last, subagents. Crush can now spawn a little team of friendly subagents in the background, as well as check on them, send them mid-run follow-ups, stop them, or move them to a different model.

You can watch them work right in the transcript, sidebar and header. Every subagent gets its own name, too, so you always know who's doing what. And, if you refer to them by name, Crush will know which of ’em you’re talking about!

🚨 Sysadmin Mode

Ever wish Crush could DROP SCHEMA public CASCADE;? Now it can, with Sysadmin mode! In fact, in Sysadmin mode, Crush can run any command on your system. Be careful.

Find Sysadmin mode in the command palette (<kbd>ctrl+p</kbd>) or toggle through all modes with <kbd>shift+tab</kbd>.

🙅🏻‍♀️ Safe Commands

Of course, Yolo Mode still blocks dangerous commands, but now which commands are dangerous is up to you.

permissions safe marks commands safe for yolo
permissions block blocks commands completely
permissions unblock unblocks restricted commands


# Building is fine

permissions safe "go build" "cargo check"

# Don't touch my infra please

permissions block kubectl terraform

# Curl your heart out

permissions unblock curl

🗝️ PGP and SSH

It’s so annoying when you’re using an AI agent and can’t enter an SSH password, activate your Yubikey and enter GPG passwords, eh? Well, with Crush, that annoyance is a thing of the past.

No more compromising your security to when usin’ AI!

There’s tons more stuff in the changelog below, too.

This is one of our biggest releases, and we're so grateful for your support!

Have a great day, The Charm Team ⭐

Changelog

New!

965d1a794bbe5c01c2f0e5b62293791060d81622: feat(agent): dispatch detached sub-agents and message them mid-run (@taciturnaxolotl)
938fef205ca1ba6a35d5ff9f93e69b5c31d41a83: feat(agent): let agent_send move a subagent to a different model (@taciturnaxolotl)
f7179d1624643b84fb350528c85d86407541ac6e: feat(bash): judge a chain of read-only commands by its parts (@taciturnaxolotl)
46c7bc4a65a2c3553b35eed7e4916871e9df3760: feat(config): let a project configure the commands it runs all day (@taciturnaxolotl)
4efcd2c345fe9b7d5462d73bfd6e40dde379c731: feat(message): carry a sub-agent report as its own message part (@taciturnaxolotl)
44cb8e3a8aeb6d555ce9de3886c3efdd76ef01b5: feat(permissions): add sysadmin mode (@taciturnaxolotl)
526da24eceeba1ab4516d2da7d0ccf6faf96636c: feat(permissions): make the dangerous-command list configurable (@taciturnaxolotl)
c42442d94b304a64ca208d819dee9894188815bf: feat(permissions): stop asking about dangerous commands in yolo mode (@taciturnaxolotl)
d4430bcce9c80d0f71f1a96dba921db85110bac4: feat(subagents): give each subagent its name for real, not just on screen (@taciturnaxolotl)
d11509b7899a720852899afc55211088aa4c1272: feat(subagents): shuffle first names, accent them, and set them apart on screen (@taciturnaxolotl)
c55f231c328a047a1710574ab32d677e368a87de: feat(ui): calmer subagent messages and a readable status (@taciturnaxolotl)
e498ee2a4557623594ccc837b3678c97a2994639: feat(ui): make a dangerous permission prompt harder to approve by reflex (@taciturnaxolotl)
573e1fb2442d7ae41fdd75ff147e34a8c981f1a6: feat(ui): name subagent actions for what they do (@taciturnaxolotl)
ae4f92c5f3cb56f57177b1e4b4efd649e65b7fb3: feat(ui): polish how sub-agents read in the transcript (@taciturnaxolotl)
99104438bccddf50f03907b0115346cfe4d7c0c9: feat(ui): put sysadmin mode in the Shift+Tab cycle (@taciturnaxolotl)
36bf1011bf6d5e3e99ca176b2065f563f666a524: feat(ui): render queued subagent reports compactly and give attachments room (@taciturnaxolotl)
49e77237920ca10df5a33b2b334bc9cb88e106c7: feat(ui): show sub-agent progress in the transcript, header, and quit dialog (@taciturnaxolotl)
16b7ee1e03157066766b068f5c23a846e6c2eb9e: feat: custom SSH password handling (#3883) (@andrinoff)
a5a7820b5793ede9258295fa321eae3ed8c58eff: feat: custom pinentry in crush (#3773) (@andrinoff)

Fixed

77a65f0b79e355d3401e2c02f7aaa0c2fea2dfa0: fix(agent): end the turn while subagents work instead of polling for their reports (@taciturnaxolotl)
92d5877f3ab396fed8245e2d0916bce54b4487bc: fix(agent): queue a subagent report until the model reads it, behind the user's own messages (@taciturnaxolotl)
280ea8950715ce73dc833827085f65689675aaea: fix(agent): stop title generation from outliving its run (@taciturnaxolotl)
9345eef3e8f87c2e5b2449c0d80964abb59e0be4: fix(agent): surface truncated and provider-stopped responses (#4233) (@andreynering)
13b478156ae6534664cac5efa32e35456a80c29e: fix(agent): tell the parent why a subagent stopped without a report (@taciturnaxolotl)
b18531d6b0971f36d443d2569fb453cd61cfd090: fix(agent): use routed model pricing for Prism session costs (#4236) (@andreynering)
53aa4dabb5429330e789bb96b72397adcca2175e: fix(auth): share one AWS SSO login and let a cancelled request stop waiting (@taciturnaxolotl)
d3b899755b559db323a69adcfbdd6a6a70cc07dc: fix(bash): decide auto-approval from the parsed command, not its prefix (@joestump)
7f1500e8446a6a8feaef00059d905bdc1f9dcf9e: fix(bash): reject backslash escapes in literal words (@joestump)
15c37e355ff087de191efc6d3135ffd8fe4d334f: fix(bash): stop an unreadable command from waiving checks for its neighbours (@taciturnaxolotl)

What the release notes say