v0.57.0

# Session Hardening, Token Savings and More

There are a bunch of solid housekeeping improvements in this release, including opt-in token savings and some serious work on session integrity and guarding against session corruptions.

## Fewer Tokens (Preview)

In this release we're introducing a new flag that reduces the size of tool call descriptions by about 98%, which we're estimating will save about 120K tokens/session! The `tl;dr` is that LLMs are a lot better nowadays at tool descriptions and shorter descriptions will do.

We're just keeping this behind a flag a bit to test more models with it, but find it generally works well for most models. If you want to opt-in, just do:

```bash
export CRUSH_SHORT_TOOL_DESCRIPTIONS=1
```

## Session Hardening

When a session becomes corrupted, things really suck. This release contains two fixes to prevent that:

* Crush will now detect malformed image data and gracefully handle it so the session doesn't break. This is a common situation when doing frontend web development, including using MCPs, like Figma's MCP.
* Prior to this fix, tool calls could fire off while streaming, which could result in tool results without tool calls. This would in turn result in a corrupted sessions. Not anymore!

## Better skill discovery

@huaiyuWangh came in hot with another solid patch, this time improving how Crush discovers and parses your skills, particularly in non-latin contexts (e.g. Chinese, Japanese, Korean, Arabic, and so on).

## Crush Info Improvements

The `crush_info` tool also got a little bit smarter, and now show your attribution settings.

If you don't yet know, `crush_info` is a tool available for the model that shows your current Crush configuration. It's one of the things that helps Crush to debug and configure itself. Pair it with `crush_logs` and the `crush-config` skill and you'll find Crush is quite self aware!

That's all for today! Keep Crushing and see you in the next release.

Charm™

## Changelog

### New!
* a2081e1f3717e5f8d7ebd23497d5c4c821aad3ed: feat(config): support `HYPER_API_KEY` for hyper auth (#2583) (@andreynering)

### Fixed
* 7a6a179ccc0fc1d5744bad3a7ccabd085a6474ca: refactor: simplify skills parsing and improve discovery visibility (#2350) (@huaiyuWangh)
* 4a1298ecd1dff83e1e704ca6b65b5a18d86e0490: chore: bump bubbletea and ultraviolet to v2.03 and 73592393e1ad and fix (@aymanbagabas)
* 4d62229045b4cc0242056ae2b57caedb14a53320: fix(tools/bash): restore cross-platform instructions in bash tool (@meowgorithm)
* efe42e801fbb5a44db1463f2e8ace2957328e504: fix(agent): prevent session corruption due to malformed image data (#2597) (@meowgorithm)
* c41a1a0e40b90fa2ce20b076a3741cfa6dbdff8a: fix(agent): validate tool call/results + strip tags from titles (@meowgorithm)
* e5712f07f08e1a6d81e07ab766dd3528251c3713: fix(ci): use stable Go version in security workflow (@aymanbagabas)
* d9f857fb29317f25d2af8f7104802d88b3417a5b: fix(events): prevent early events from being dropped before init (#2611) (@meowgorithm)
* d96d0443c2d61e4684514ce8545dd3db919063e3: fix(tools): add missing strconv import (@meowgorithm)
* f78baed0f06e40a3be64d21c69422ef8a6def832: fix(tools): drastically reduce tool call description lengths (@meowgorithm)
* 2e8767df512b4ab2245c7477f1f18ad6ae690c27: fix(tools): modernize string split (@meowgorithm)
* 40b7cdd46685c3d4b96b74cdcab48a2181951cb0: fix(ui): format code in ui.go (@aymanbagabas)
* 95fcd88870eee23c0389d97784b297b1482ccb15: fix: show attribution setting on `crush_info` tool (#2594) (@andreynering)
* b680a4a1cf96e757d772e7f462e08da2809418e2: fix: use proper bool check (@meowgorithm)
### Other stuff
* 3e8c1489e44f5cf34f4702fefe2ec98a81b9e2c6: chore(agent): move filter logic into a function (@meowgorithm)
* ff003b461548c4efd0a41178d31aac00a07e80bc: chore(tests): re-record vcr cassettes (@meowgorithm)
* a02ce4a98b6af7ff4f75491d838c901f4a3916a4: chore(tools): gate short descs with CRUSH_SHORT_TOOL_DESCRIPTIONS (@meowgorithm)

---

<details>
<summary>Verifying the artifacts</summary>

First, download the [`checksums.txt` file](https://github.com/charmbracelet/crush/releases/download/v0.57.0/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://github.com/charmbracelet/crush/releases/download/v0.57.0/checksums.txt.sigstore.json) files, for example, with `wget`:

```bash
wget 'https://github.com/charmbracelet/crush/releases/download/v0.57.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.57.0/checksums.txt.sigstore.json'
```

Then, verify it using [`cosign`](https://github.com/sigstore/cosign):

```bash
cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt
```

If the output is `Verified OK`, you can safely use it to verify the checksums of other artifacts you downloaded from the release using `sha256sum`:

```bash
sha256sum --ignore-missing -c checksums.txt
```

Done! You artifacts are now verified!

</details>

<a href="https://charm.land/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a>

Thoughts? Questions? We love hearing from you. Feel free to reach out on [X](https://x.com/charmcli), [Discord](https://charm.land/discord), [Slack](https://charm.land/slack), [The Fediverse](https://mastodon.social/@charmcli), [Bluesky](https://bsky.app/profile/charm.land).