August 30, 2026

Rush CLI 0.2.38

Name: Rush
Author: Phoenix Horizon, Inc.

Install

macOS / Linux

curl -fsSL https://cdn.getrush.ai/install.sh | bash

Windows

irm https://cdn.getrush.ai/install.ps1 | iex

Homebrew

brew install phnx-labs/tap/rush

Debian / Ubuntu

sudo apt install rush-cli

Already installed?

rush upgrade

rush login now uses Phoenix ID, the same human identity as agents CLI and prix.dev (PHNX-3546). Every login uses the RFC 8628 device flow at id.byphoenix.com: the terminal prints a short code and a URL that works from any browser or phone, including SSH/headless hosts. After approval, Rush stores the opaque Phoenix bearer directly as the session in ~/.rush/user.yaml — no exchange step, no refresh token, and no local expiry. prix-api verifies the bearer per request against Phoenix ID (PHNX-3543), and the daemon serves the stored non-expiring bearer (expires_at: 0) without ever attempting a Supabase refresh. The former direct Supabase Google/localhost/paste-code OAuth paths — and the --no-browser/--callback-port/--paste-code/--device flags, deprecated in the prior release — are removed, eliminating the second user-facing identity flow.
- Depends on prix-api Phoenix-bearer acceptance (PHNX-3543) being deployed to the target environment before this ships there: until then api.prix.dev returns 401 for a raw Phoenix bearer. Verified end-to-end against live id.byphoenix.com (device approval → pid_… bearer stored with expires_at: 0, accepted by Phoenix /api/v1/auth/me).

rush cloud accounts add accepts the compliant API-key providers the Prix API already requires (PHNX-3597). --provider claude-api-key and --provider openai-api-key now pass CLI validation and reach POST /api/v1/cloud-accounts, matching the server contract and the remediation commands printed by failed cloud dispatches. Help/examples list all four account-provider literals; unsupported values still fail before the CLI reads a credential.
Daemon-less auth works with a Phoenix bearer (PHNX-3546 follow-up). The CLI-side session fast path (GetValidAuthConfig, EnsureSessionTokenFresh) judged freshness by parsing the token as a JWT — which an opaque pid_… Phoenix bearer never is — so it always missed and forced every session read through the daemon, failing outright where no daemon runs (cloud pods, RUSH-1310). Freshness now spans both shapes: a JWT is judged by its exp, an opaque bearer by the stored expires_at (0 = non-expiring), matching the daemon's own isFresh. Regression tests cover the opaque-bearer fast path with no daemon.

Checksums are published for the current latest release. Verify older binaries against rush --version after install.