Subagents, Sysadmin Mode, and PGP/SSH Prompts

This is a big one! Crush can now run a team of subagents, permissions are much more flexible, and you can now do GPG and SSH auth right inside Crush! Read on for more.

👩🏼‍🐰‍👩🏽 Subagents

At last, subagents. Crush can now spawn a little team of friendly subagents in the background, as well as check on them, send them mid-run follow-ups, stop them, or move them to a different model.

You can watch them work right in the transcript, sidebar and header. Every subagent gets its own name, too, so you always know who's doing what. And, if you refer to them by name, Crush will know which of ’em you’re talking about!

🚨 Sysadmin Mode

Ever wish Crush could DROP SCHEMA public CASCADE;? Now it can, with Sysadmin mode! In fact, in Sysadmin mode, Crush can run any command on your system. Be careful.

Find Sysadmin mode in the command palette (ctrl+p) or toggle through all modes with shift+tab.

🙅🏻‍♀️ Safe Commands

Of course, Yolo Mode still blocks dangerous commands, but now which commands are dangerous is up to you.

• permissions safe marks commands safe for yolo
• permissions block blocks commands completely
• permissions unblock unblocks restricted commands

# Building is fine
permissions safe "go build" "cargo check"

# Don't touch my infra please
permissions block kubectl terraform

# Curl your heart out
permissions unblock curl

🗝️ PGP and SSH

It’s so annoying when you’re using an AI agent and can’t enter an SSH password, activate your Yubikey and enter GPG passwords, eh? Well, with Crush, that annoyance is a thing of the past.

No more compromising your security to when usin’ AI!

There’s tons more stuff in the changelog below, too.

This is one of our biggest releases, and we're so grateful for your support!

Have a great day,
The Charm Team ⭐

Changelog

New!

• 965d1a7: feat(agent): dispatch detached sub-agents and message them mid-run (@taciturnaxolotl)
• 938fef2: feat(agent): let agent_send move a subagent to a different model (@taciturnaxolotl)
• f7179d1: feat(bash): judge a chain of read-only commands by its parts (@taciturnaxolotl)
• 46c7bc4: feat(config): let a project configure the commands it runs all day (@taciturnaxolotl)
• 4efcd2c: feat(message): carry a sub-agent report as its own message part (@taciturnaxolotl)
• 44cb8e3: feat(permissions): add sysadmin mode (@taciturnaxolotl)
• 526da24: feat(permissions): make the dangerous-command list configurable (@taciturnaxolotl)
• c42442d: feat(permissions): stop asking about dangerous commands in yolo mode (@taciturnaxolotl)
• d4430bc: feat(subagents): give each subagent its name for real, not just on screen (@taciturnaxolotl)
• d11509b: feat(subagents): shuffle first names, accent them, and set them apart on screen (@taciturnaxolotl)
• c55f231: feat(ui): calmer subagent messages and a readable status (@taciturnaxolotl)
• e498ee2: feat(ui): make a dangerous permission prompt harder to approve by reflex (@taciturnaxolotl)
• 573e1fb: feat(ui): name subagent actions for what they do (@taciturnaxolotl)
• ae4f92c: feat(ui): polish how sub-agents read in the transcript (@taciturnaxolotl)
• 9910443: feat(ui): put sysadmin mode in the Shift+Tab cycle (@taciturnaxolotl)
• 36bf101: feat(ui): render queued subagent reports compactly and give attachments room (@taciturnaxolotl)
• 49e7723: feat(ui): show sub-agent progress in the transcript, header, and quit dialog (@taciturnaxolotl)
• 16b7ee1: feat: custom SSH password handling (#3883) (@andrinoff)
• a5a7820: feat: custom pinentry in crush (#3773) (@andrinoff)

Fixed

• 77a65f0: fix(agent): end the turn while subagents work instead of polling for their reports (@taciturnaxolotl)
• 92d5877: fix(agent): queue a subagent report until the model reads it, behind the user's own messages (@taciturnaxolotl)
• 280ea89: fix(agent): stop title generation from outliving its run (@taciturnaxolotl)
• 9345eef: fix(agent): surface truncated and provider-stopped responses (#4233) (@andreynering)
• 13b4781: fix(agent): tell the parent why a subagent stopped without a report (@taciturnaxolotl)
• b18531d: fix(agent): use routed model pricing for Prism session costs (#4236) (@andreynering)
• 53aa4da: fix(auth): share one AWS SSO login and let a cancelled request stop waiting (@taciturnaxolotl)
• d3b8997: fix(bash): decide auto-approval from the parsed command, not its prefix (@joestump)
• 7f1500e: fix(bash): reject backslash escapes in literal words (@joestump)
• 15c37e3: fix(bash): stop an unreadable command from waiving checks for its neighbours (@taciturnaxolotl)
• dc2543b: fix(config): drop reasoning options a model cannot use when switching to it (@taciturnaxolotl)
• 1662cbd: fix(db): keep sub-agent prompts out of the prompt history (@taciturnaxolotl)
• b9f30dd: fix(permissions): harden the dangerous-command check (@taciturnaxolotl)
• fd40067: fix(permissions): scope a session approval to what was actually approved (@taciturnaxolotl)
• 2000857: fix(pubsub): keep only the newest pending update per message for slow subscribers (#4184) (@taciturnaxolotl)
• 21e09eb: fix(server): don't show an error for diagnostics (#4216) (@andrinoff)
• 95d807a: fix(server): report the permission mode the server is actually enforcing (@taciturnaxolotl)
• ac2ce4a: fix(shell): apply the command block list to scripts and builtins (@taciturnaxolotl)
• f88e147: fix(shell): cap the output a command keeps in memory (#4183) (@taciturnaxolotl)
• 7690581: fix(shell): detect command chaining by parsing, not string matching (@taciturnaxolotl)
• 963a600: fix(shell): harden command blocking against common evasions (@taciturnaxolotl)
• ab1125f: fix(shell): match dangerous commands regardless of case (@taciturnaxolotl)
• 5951fe1: fix(shell): say what is dangerous in plain words (@taciturnaxolotl)
• 8a3ff03: fix(ssh): let sshpass and other terminal drivers answer ssh prompts (@taciturnaxolotl)
• 9c32a18: fix(subagents): always give a new subagent its own first name (@taciturnaxolotl)
• ad2d695: fix(subagents): check status without formatting a subagent's whole history (@taciturnaxolotl)
• 19c626d: fix(subagents): forget finished subagents past a small cap (@taciturnaxolotl)
• b7008c6: fix(subagents): keep a subagent's report when the turn it was waiting on is cancelled (@taciturnaxolotl)
• ee9a0e3: fix(subagents): read the parent model without racing the agent build (@taciturnaxolotl)
• 0f6f8f9: fix(subagents): run a queued follow-up even when it misses the last step (@taciturnaxolotl)
• 594715c: fix(subagents): stop follow-ups racing a subagent finishing or being forgotten (@taciturnaxolotl)
• af3d551: fix(ui): color the git branch in the header like the path beside it (@taciturnaxolotl)
• 1c5ad82: fix(ui): drop "done" from finished subagents in the sidebar (@taciturnaxolotl)
• a8686cc: fix(ui): drop the blank tail glamour leaves under markdown tool output (@taciturnaxolotl)
• 9f52df7: fix(ui): find a subagent's item with one lookup per event (@taciturnaxolotl)
• 3b1f860: fix(ui): keep the keybind hints from running under the sidebar (#4044) (@taciturnaxolotl)
• 6ffe808: fix(ui): match subagent headers to MCP tool headers (@taciturnaxolotl)
• 58164e4: fix(ui): shorten a subagent's label so the sidebar keeps its time (@taciturnaxolotl)
• 673b7be: fix(ui): show a queued subagent report like its transcript header (@taciturnaxolotl)
• d704c29: fix(ui): show only a subagent's latest tool calls until expanded (@taciturnaxolotl)
• 8401d66: fix(ui): treat a backgrounded agent call as the subagent it became (@taciturnaxolotl)
• 47025a9: fix: incorrectly building assistant message (#4226) (@andrinoff)
• 0f3d0d3: fix: keep browser output off the terminal (#4235) (@remote-controlled-man)
• 8c4ab7e: fix: replay data correctly for anthropic (#4237) (@andrinoff)

Other stuff

• 5e944c0: chore: auto-update files (@charmcli)
• b576f95: chore: auto-update files (@charmcli)
• 49c1013: chore: auto-update files (@charmcli)
• 3a81958: chore: auto-update files (@charmcli)
• 491479a: chore: call them subagents everywhere a person or model reads it (@taciturnaxolotl)
• 3a67c58: ci(release): faster releases (#4231) (@andrinoff)
• d55c725: feat(sub-agents): let sub-agent dispatches override the model and provider (#4157) (@andreynering)
• adbd3c9: feat(sub-agents): show the model only providers and models it can actually use (@taciturnaxolotl)
• d2a9d04: fix(password-prompt): address visual review (#4227) (@andrinoff)
• e3afa17: fix(sub-agents): tidy the loose ends in model overrides (@taciturnaxolotl)
• 50dba64: readme: update Hyper model description and metrics info (@meowgorithm)
• 46b15d4: refactor(sub-agents): give model overrides a file of their own (@taciturnaxolotl)
• 752f411: refactor(sub-agents): pick a sub-agent's reasoning the way the model supports it (@taciturnaxolotl)
• e3fe4bb: refactor(subagents): drop duplicated defaults, dead filtering and a second busy check (@taciturnaxolotl)
• a5b136a: refactor(subagents): fewer moving parts in naming and resumes (@taciturnaxolotl)
• f52039e: refactor(subagents): read subagent control params with their own types (@taciturnaxolotl)
• 5ab8180: refactor(subagents): run backgrounded calls through the dispatch path (@taciturnaxolotl)
• 2e88f3d: refactor(subagents): save a report before waking the parent, not through the queue (@taciturnaxolotl)
• d8aa65e: refactor(ui): share one row-truncation rule across sidebar sections (@taciturnaxolotl)
• 2510bc2: subagents: additional friendly names (@meowgorithm)
• 3e6b751: ui/ux: bash tool display improvements (#4126) (@plutonium-239)

wget 'https://github.com/charmbracelet/crush/releases/download/v0.100.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.100.0/checksums.txt.sigstore.json'

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/charmbracelet/crush/\.github/workflows/(release|nightly)\.yml@' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

sha256sum --ignore-missing -c checksums.txt

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.