August 28, 2026

Rush CLI 0.2.37

Name: Rush
Author: Phoenix Horizon, Inc.

Install

macOS / Linux

curl -fsSL https://cdn.getrush.ai/install.sh | bash

Windows

irm https://cdn.getrush.ai/install.ps1 | iex

Homebrew

brew install phnx-labs/tap/rush

Debian / Ubuntu

sudo apt install rush-cli

Already installed?

rush upgrade

Channel-sourced runs no longer hang for minutes on a hardware capability (PHNX-3407). A --channel-mode run (Slack/Discord/Telegram/WhatsApp) kept stdin for consent/sync_render but its executor never answers hardware capability_request events, so user_location/camera/computer calls dead-waited the stdin handler's full 5-minute timeout before failing — the single largest idle-time source in the Evals console (rush-assistant asking for GPS in a chat channel that can never provide it). selectHostOpHandler now routes channel and headless runs to the fail-fast capability handler (HTTP bridge if a Rush app is reachable, else "unavailable" in under 1s), so the agent asks the user instead of hanging. rush/cli/internal/cli/hostop_handler.go.
BYOK (bring-your-own-key) header injection is re-enabled (RUSH-2867). rush run, rush serve, rush eval, and rush build's QA check now attach a stored provider key as X-BYOK-Key again. This was disabled in RUSH-1251 because the app's Providers tab was hidden, so a stale Keychain key silently overrode the server key on every call with no way for the user to see or clear it. The Providers tab is restored (rush/app), and prix-api's classifyProviderError (RUSH-1249) already stopped mislabeling a rejected BYOK key as "Session expired".

Windows rush-cli.exe is now Authenticode-signed at release. scripts/release.sh signs the windows-x64 and windows-arm64 binaries via SSL.com eSigner CodeSignTool (cloud OV cert, Phoenix Horizon, Inc.) — the same cert path the Rush app uses (rush/app/scripts/windows-sign.cjs). An unsigned
- garble-obfuscated rush-cli.exe was being quarantined by Microsoft Defender as a false Trojan:Win32/Gracing detection (a cloud/definition-driven verdict that hits default Defender on most machines), which broke install.ps1 for Windows users. The release now fails closed when the eSigner credentials are unset (ESIGNER_USERNAME, ESIGNER_PASSWORD, ESIGNER_TOTP_SECRET, ESIGNER_CODESIGNTOOL); pass RUSH_ALLOW_UNSIGNED=1 for a local-only emergency build. macOS (codesign + notarize) and Linux (GPG-signed apt repo) paths are unchanged.

Checksums are published for the current latest release. Verify older binaries against rush --version after install.