Small fixes

Hey all. This is just some small fixes to start the week.

Fixed multi-session token refresh

Crush currently support two OAuth-based providers: Hyper and Copilot. For these integrations we need to refresh tokens once they expire.

We fixed an issue affecting users that have multiple Crush instances running at the same time. Before attempting to refresh a tokens, Crush will now look on the disk if it was already refreshed by another instance.

Tip

Didn't know about Hyper yet? Check out our announcement on the past release!

Rendering performance

We did improvements on some internal caching to boost rendering performance on big sessions.

SQLite enhancements

@taoeffect helped with enhancements on how our SQLite driver configuration. This will mitigate some edge cases we've seen where Crush databases could be corrupted.

See ya!
Charm

Changelog

Fixed

99bc5ce: fix(config): check config file for newer token before OAuth refresh (@andreynering)
4010841: fix(db): prevent SQLITE_NOTADB corruption under concurrent sub-agents (#2690) (@taoeffect)
19197e3: fix(ui): cache glamour renderers (@meowgorithm)

Other stuff

ecebe91: chore: auto-update files (@charmcli)
1ed6f52: refactor(ui): pair markdown cache invalidation with the styles mutation (@meowgorithm)

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.65.3/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.65.3/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/crush v0.65.3 on GitHub