v0.88.0

# `.crushrc` is here!

Hey! Hope everybody had a great week. We were pretty productive at Charm and we're releasing some cool stuff today.

## Bash configuration! (`.crushrc`)

Yep, `.crushrc` has come! You existing JSON config still works, but we just started migrating to something a lot more flexible!

An example on why this is cool: if you manage Crush config in a `dotfiles` repo, you can still have machine-specific overrides by using `source` to call a separate file that will be in your `.gitignore`. I'm sure there are many other use cases.

To read the full documentation on this, [read this document](https://github.com/charmbracelet/crush/tree/main/docs/config).

See a snipped so you have an idea on how it looks:

```bash
# Add Ollama.
provider add ollama --type ollama --base-url "http://localhost:11434/v1"

# Register a model on Ollama.
model add ollama/llama3.3 --name "Llama 3.3" --context-window 128000

# Auto-approve some tools.
permissions allow view edit

# Add an MCP server
mcp add github \
  --type http \
  --url "https://api.githubcopilot.com/mcp/" \
  --header Authorization "Bearer $GITHUB_TOKEN"

# Load some extra config
source "$XDG_CONFIG_HOME/squid-config.sh"

# Change config based on the machine you're on.
if [[ $HOSTNAME == "babysquid" ]]; then
    option skill-path "$HOME/squid-skills"
fi
```

Want to give feedback? Join the `#crush` channel on [Discord](https://charm.land/discord).

## Better AWS Bedrock SSO support

@jan-xyz did a great job bringing this one to life!

When using AWS Bedrock via SSO, tokens expire with time and need to be refreshed. Crush now has a proper configuration and UX for authenticating, and it will appear whenever tokens need to be refreshed.

To read more about it, see #2886.

<img width="572" height="231" alt="Screenshot 2026-07-31 at 18 04 21" src="https://github.com/user-attachments/assets/993034d2-89d2-42f4-ba9c-30b01a1debd6" />

## More reliable Agent Fetch

@sven2718 contributed with better retries in searches when they don't work in the first try. Searches will be more reliable now, specially when doing many in a short period of time.

## Fix for Fable 5

@sven2718 also contributed with a fix for Fable 5. When Anthropic decides to reject your prompt for security reasons, we'll now a proper error message in Crush. Before, Crush would just stop without giving context on why.

## Crush now compiles on IlluminOS

Never heard of [IllumiOS](https://illumos.org/)? Neither none of us at Charm, but @timotheosh adjusted the code to ensure it compiles there now!

Go compiles to many environments, and it's always fun to see Crush working on more operating systems! By the way, do you know you can use Crush on Android? :robot:

## Enhanced MCP OAuth

In the last release, we shipped support for OAuth authentication for MCPs.

@BrunoKrugel did a few fixes to make more MCPs that require OAuth work as expected.

## Agentic fixes

Quite a few fixes were made to Crush as an agent as well. Some of these were made on [Fantasy](https://charm.land/fantasy) and brought to Crush.

## New Hyper models

Not less important, we keep bringing updates to [Hyper](https://hyper.charm.land), which is more stable than ever and has Minimax M3 and Qwen3.7-Flash avalable now.

---

A lot happened this week! We hope you enjoy, and Keep Crushing :tm:!
Charm

## Changelog
### New!
* 9e3ed61cfb6e1a6f087fef45e3a76faa9289a01e: feat(bedrock): retry the turn automatically after AWS SSO re-auth (@jan-xyz)
* 7810d0382d8d7699ddbaa2f9bbc484d5e6daaace: feat(config): apply top-level env vars on startup (@jan-xyz)
* 155072b32603bb0ebc2594fc90c2e47e25d2f566: feat(noninteractive): make the spinner text use terminal default (@taciturnaxolotl)
* 1c074540c33e76b22bb3536541a9422e05a63404: feat(oauth): give the browser redirect a real landing page (@taciturnaxolotl)
* c74146308cf8a02a3ebace4af07fa78acd259fa4: feat: add "option reset" to wipe shell config list options (@meowgorithm)
* 987ba71fba70b2d2bc9bbbb878ba8b437e1a416d: feat: add crush.sh discovery and loading (@meowgorithm)
* 528d8379b9785b96de0738acf292b93a30eb2566: feat: add permissions deny to hide tools from the agent (@meowgorithm)
* a5156e62153d7c35c53a2953230e046a9f24c9a5: feat: add provider-model builtin for defining provider models (@meowgorithm)
* 3f54c0e9ec522f2ffdeb66c6a94206f717189b0b: feat: add shell config builtins and ConfigBuilder infrastructure (@meowgorithm)
* c2b8f164564e381c32f04841e16c7ac7f35823d4: feat: add structured logging to shell config builtins (@meowgorithm)
* 9d31a1a45bb666c2a61d00024bbdaaf2443d8b87: feat: add verb-first hook add/remove shell config commands (@meowgorithm)
* eea3bf7fc1dc8364020d1dd11ba5f85de106f8dc: feat: add verb-first lsp add/remove shell config commands (@meowgorithm)
* 9a3cdbf99326b80fcc2c5dcd2f83764eccdcfd3e: feat: add verb-first mcp add/remove shell config commands (@meowgorithm)
* 52e041cdec17222d707f8bdf4ce51e27d41de6c1: feat: clarify model pricing flags in crushrc (@meowgorithm)
* c6fb635c895048887a6fadb72d0951706726943b: feat: configure attribution from crushrc (@meowgorithm)
* e99b8d6824f36f91835bb3fc043954e18eb44dbf: feat: expose CRUSH_VERSION to shell config scripts (@meowgorithm)
* 0b584610efa1a8d9ea7046e9b6268c1f87468f3d: feat: expose remaining advanced config through crushrc (@meowgorithm)
* 8bf07dab012aa70cccfaf18cb343442ff8a3801f: feat: make permissions use verb-first allow subcommand (@meowgorithm)
* 650bf3c2cd3ab8d1b90fab4687da9415e58766cc: feat: rename shell config to crushrc with local .crushrc override (@meowgorithm)
* 479da0f3f62f45540506c2a7d38182cffd1492f5: feat: verb-first provider and model shell config commands (@meowgorithm)
### Fixed
* 5e1cd7efe90f60caba4aa3febe919a5d7183faf5: (fix: fable) surface model refusals in the TUI instead of silently stopping work (#3453) (@sven2718)
* 63dc1f01b7ebf688fc333f1474cf0d23439c4f06: fix(auth): stop parallel sessions from invalidating each other's login (@taciturnaxolotl)
* 21619894abc598da8d0626dd5599568e0935ca06: fix(config): capture rollback snapshot before configureProviders (@taciturnaxolotl)
* 20e4dbc68e43e9548f471edaad97e4e8358a8dfb: fix(config): only warn when JSON and crushrc keys actually conflict (@taciturnaxolotl)
* 4dd4442a4a374f2bf51dd26de3b2b62e9f51932c: fix(config): retry transient Windows rename failures in atomicWriteFi… (#3469) (@joestump-agent)
* c7a59999560c4ffeba878c6e952799a611ec27c2: fix(config): track all discovered config paths for staleness (@taciturnaxolotl)
* ecdc6ed1d2b38c74bbbbeabd7ae4964549abaa7b: fix(config): validate crushrc JSON output, skip empty config paths (@taciturnaxolotl)
* b679ba1e0bba139562bd43a81c95770910a3ee58: fix(edit): auto-correct whitespace mismatches in edit tool (@taciturnaxolotl)
* 677046d28d5f794636787b18de5a93282ba18d17: fix(illumos): support building and running crush" (#3422) (@timotheosh)
* 560986ca010462769361ee46012f29eab05131ae: fix(mcp): MCP server loading in server-client mode (@meowgorithm)
* 2ca5a8c3680a5c04cd7673ce981e29d95f4059bb: fix(mcp): normalize oauth metadata redirects (#3415) (@BrunoKrugel)
* e68041a674711eb4986ee26e3e3bac1677fc41ca: fix(mcp): pin go-sdk to main for protocol version header fix (#3421) (@taciturnaxolotl)
* c3fd60ea6ac05eb7732bc3847e87791365fab7a7: fix(mcp): remove orphaned tokens from oauths MCP (#3418) (@BrunoKrugel)
* 3a71bdf3adac93930a13d20bbdac308a915fa1d1: fix(noninteractive): don't block non interactive mode on session title (@taciturnaxolotl)
* 954deae9ea9d146aefe99466eb63ea77578091dc: fix(server): deliver permission and question events reliably to clients (@taciturnaxolotl)
* 359c13f7aa195a3208cf75b60df53bdca0f2b0c9: fix(shellconfig): assert section/childMap don't overwrite non-map values (@taciturnaxolotl)
* a45ab254f99145eb22fde5068bf35e64d98002bc: fix(shellconfig): bound crushrc execution with context and timeout (@taciturnaxolotl)
* f14e773d9bd0b900a1c34074d65bbfe9b3ae5ecf: fix(shellconfig): dedup model add, document optionSpecs, pin deny target (@taciturnaxolotl)
* de671233b9f4eadcbc6aae4b3846800b7f72c490: fix(tools): surface DuckDuckGo rate limiting instead of empty results (@sven2718)
* 80ce583417c58a8abbfaa8de85a04b3d8eec586c: fix(ui): prevent double spinner on session reload after kill (#3457) (@taciturnaxolotl)
* b0c8c24a9076814fd54631fd17788f3c72a1c577: fix: accept mixed-case booleans in shell config (@meowgorithm)
* f13f8ebb9d7be16890b30a8bcb0f13876e1ed174: fix: discover global crush.sh, not just crush.json (@meowgorithm)
* 601f7f7dcbdeeaeb455d6a7ba6ac62b7f83d3b3b: fix: make crushrc source test pass on Windows (@meowgorithm)
* 7d8e93fb5783890266c8f6a016b84d1a898dc280: fix: never execute crushrc from machine data directories (@meowgorithm)
* ad709357ac90327fa41115ce7fd84cc89d839e0c: fix: resolve short session IDs in local 'crush run --session' (#3460) (@taciturnaxolotl)
* 884391f90f30dc215b31be6dd5ed5a3e832503f6: fix: stop long thinking blocks from re-rendering the entire document every frame (#3454) (@taciturnaxolotl)
### Docs
* 6fc78009db9743bd5c53faa04fd70ce71a28b5b8: docs(config): add notes on future state migration, update readme/docs (@meowgorithm)
* d8cae42ba5dc417db2f72438e55647ae7b2cea0b: docs(config): add windows paths, copyedits (@meowgorithm)
* 77444e407bfaee5124751a78ed337cb860d6b145: docs(config): make documentation more human (@meowgorithm)
* 0813dcb08d5318d87c939208e78e4a0636b41f8d: docs(crushrc): note that empty headers are dropped from requests (@meowgorithm)
* da35cd7da9c04ae609cc35b8ec5503e3d22ec165: docs(readme): improve flow of configuration section a bit (@meowgorithm)
* 874c0af8dfff0c34867b1efa3483df36ba632c09: docs(readme): update readme per bash-based config (@meowgorithm)
* f02ffbcec15a9f95cb9bcff895833df10f829aae: docs(ui): capture dialog rendering and chat perf rules (@taciturnaxolotl)
* 6f9b90c8ec30b736ca93a22a2878b468729dace7: docs: add config guide and future-work notes (@meowgorithm)
* 6421a2ba1a5793bd05359a7cca04ee64d832ef1a: docs: default crush-config skill to the crush.sh format (@meowgorithm)
* 810168b058cf53cbe510b59ba6e0d7ce17df6fe2: docs: document aws_auth_refresh and top-level env config (@taciturnaxolotl)
* 5d8af19548c1ea81496781dd812b8963e65d543e: docs: finish crushrc examples and option help (@meowgorithm)
* 3c736beb749c85feaebfef91b208e6a3e20d532a: docs: fix typos, grammar, and document deny-wins precedence (@taciturnaxolotl)
* f8c83fbe95042ab4772d5f083269027eb05639f4: docs: fix version typo and clarify config trust wording (@meowgorithm)
* 5e735ec8fc021eddab323037d2189033c26b8fd3: docs: lead README configuration with the crush.sh format (@meowgorithm)
* e3dee0b2045ca8e99d2b2d963cdfa96e4510a8f0: docs: note the deferred visible-but-always-denied tool state (@meowgorithm)
* 7b8f59f4c2bdc40ae627f6e1a3325afc98a6162c: docs: present crushrc commands as CLI-style help (@meowgorithm)
* b55a092f35980fcb54baa8ece0e80e1753ebade2: docs: update AGENTS.md with Bash config format (@meowgorithm)
* 812dc09b1ec7045d7f0024c8568d42a070101f3b: docs: use a local Ollama example in the config quick-start (@meowgorithm)
### Other stuff
* 5b88f46d34d22347e6bf71a9e1c63667c3695d84: bench(config): add crushrc load benchmark (@taciturnaxolotl)
* 0e7db4a91fa9aa78d9ae730ee2a07c355da92b1e: chore(crushrc): drop deadcode (@meowgorithm)
* 7aef2316d01c9523b3b0eef44c1eb8d2e26ffda9: chore(crushrc): log conflicting keys when json and crushrc compete (@meowgorithm)
* 38f5d98911e3f55c8e9bf6b18c353b3607b48790: chore: auto-update files (@charmcli)
* d15f793e8fc35f586f079c9916c0056d282bb9d1: chore: auto-update files (@charmcli)
* 100c8bd9750cceb440f79c27d5213df31a604634: chore: auto-update files (@charmcli)
* aa57f56120d3243f7979addb4f100147b531a620: chore: auto-update files (@charmcli)
* abceac2e2ac282055509a618556981949d3fb476: chore: auto-update files (@charmcli)
* f4ff2eaa37f397f5b2a914fe2aca2630832bca80: chore: bump fantasy to v0.39.0 (#3470) (@taciturnaxolotl)
* b83944c45805a4b7abcf3e245acddb8e58294972: chore: bump mcp sdk to 1.7.0 (#3447) (@taciturnaxolotl)
* 618a1182fafc0f467c06a3022d9ab1216ec25c32: chore: format (@taciturnaxolotl)
* def12cc6d8e162d6f48a7db260dde5ea3cc5f906: chore: gufumpt (@andreynering)
* 6785e86c1377f79cbfcc1ea728706b49117e959e: chore: merge main into crushrc (@meowgorithm)
* 15d2e1a3716d8f9fea7c75bfe7c7fb9562627567: chore: regen golden files (@taciturnaxolotl)
* 35d82d02ea8789e4f4ac78899c6a895cd84afb7e: chore: regenerate swagger docs (@taciturnaxolotl)
* 92d699898a9a1e4e03857ab0e53fab3b419af792: refactor(shell): unify jq into the builtin registry (@taciturnaxolotl)
* 5d082a14ee519a8680c3b9cb2920467162486ef2: refactor(shellconfig): collapse option type system into one table (@taciturnaxolotl)
* 7303e15ee71fb62fd26b8b31f7ccd43b18034926: refactor(shellconfig): replace copy-pasted flag loops with declarative engine (@taciturnaxolotl)
* 2a89bcacf550852b02b83cbc0b2d3ce35bc4c8fb: refactor(shellconfig): unify flagInt/flagInt64, make boolTrue a flagKind, checked assertions (@taciturnaxolotl)
* 6a6b21524710fe297ae9be4b014cbf952b2d49e0: refactor: build shell config imperatively instead of via JSON fragments (@meowgorithm)
* d8e0e734ee001cfa7b5ca3c2f178f651711ccf15: refactor: make list option keys singular (@meowgorithm)
* 84f5b9cfb14cd26fdbbaf64119158281d1416646: refactor: make permissions deny the only tool-blocking command (@meowgorithm)
* 3e176aff2980110785abe58a10d9dc77c1db8a1f: refactor: rename provider/model unset to remove (alias rm) (@meowgorithm)
* 380c219e01507e9b0c1f902dafd0feb8216ecb08: refactor: simplify shell config option booleans (@meowgorithm)
* 6c043ebc45dd37265f967999cac10698a50f3070: refactor: unify notification config under a single notifications key (@meowgorithm)
* 196dcf62a91de02a47cd2b04737b21a79ba420ec: refactor: use positional provider ID for provider-model, rename options to option (@meowgorithm)

---

<details>
<summary>Verifying the artifacts</summary>

First, download the [`checksums.txt` file](https://github.com/charmbracelet/crush/releases/download/v0.88.0/checksums.txt) and the [`checksums.txt.sigstore.json` file](https://github.com/charmbracelet/crush/releases/download/v0.88.0/checksums.txt.sigstore.json) files, for example, with `wget`:

```bash
wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.88.0/checksums.txt.sigstore.json'
```

Then, verify it using [`cosign`](https://github.com/sigstore/cosign):

```bash
cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt
```

If the output is `Verified OK`, you can safely use it to verify the checksums of other artifacts you downloaded from the release using `sha256sum`:

```bash
sha256sum --ignore-missing -c checksums.txt
```

Done! You artifacts are now verified!

</details>

<a href="https://charm.land/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-banner-next.jpg" width="400"></a>

Thoughts? Questions? We love hearing from you. Feel free to reach out on [X](https://x.com/charmcli), [Discord](https://charm.land/discord), [Slack](https://charm.land/slack), [The Fediverse](https://mastodon.social/@charmcli), [Bluesky](https://bsky.app/profile/charm.land).