← All CLI releases
September 3, 2026

Rush CLI 0.2.39

Install

macOS / Linux

curl -fsSL https://cdn.getrush.ai/install.sh | bash

Windows

irm https://cdn.getrush.ai/install.ps1 | iex

Homebrew

brew install phnx-labs/tap/rush

Debian / Ubuntu

sudo apt install rush-cli

Already installed?

rush upgrade

Added

  • rush run <agent> --cloud dispatches to Rush Cloud instead of running locally (PHNX-1933). The flag did not exist before — cobra returned unknown flag: --cloud. It bridges --prompt/--model/--mode onto the existing rush cloud run dispatcher, so auth, repo resolution, the interactive wizard, and agent support are identical between the two commands rather than a second implementation. Cloud-only flags (--repo, --harness, --workflow, --compute-provider, --isolation-tier) are not registered on rush run; use rush cloud run for those.
  • rush ssh <run-id> opens an interactive shell inside a running cloud run's engine pod (PHNX-3595). Takes the same id as rush cloud logs, over the factory WebSocket PTY endpoint with the bearer rush cloud already uses. The local terminal is put in raw mode and always restored on exit, window resizes forward to the remote PTY, and the shell exits with the remote process's exit code; a dropped socket (pod eviction, network loss) ends the session instead of stranding the terminal. Authz failures map to explicit messages (forbidden / not-found / not-ready / no-pod). The same brokered shell is reachable as rush ssh <run-id> and its top-level rush attach <run-id> alias, and under the managed surface as rush cloud attach <run-id> (itself aliased rush cloud ssh). Requires the factory WS PTY route deployed in the target environment.
  • rush cloud run --project <name> dispatches against a saved Project (PHNX-3741, PHNX-3845). The Project supplies the authorized installation, repository, and default branch, so no repo is passed — mutually exclusive with a positional or --repo target, matching the API's own guard.
  • OpenCode joins Claude Code and Codex as a managed cloud harness, transcripts included (PHNX-3845). It dispatches under its bare opencode name (no prix/* wrapper) and is treated as a coding agent — repo or Project required, auto-PR flow. OpenCode stores sessions in one SQLite database rather than JSONL, so the factory selects the run's session and normalizes it to JSONL at capture time; rush cloud transcript and the run picker render it like any other harness.
  • rush cloud run claude@2.1.219 (or codex@…, opencode@…) pins the harness CLI version for a dispatch (PHNX-3736), without rebuilding an image. The pinned form routes to the bare native ref instead of the prix/*-cli wrapper. The pod installs and verifies the exact version before the agent starts, matching on version components rather than substrings, so a 2.1.21 pin is never satisfied by an installed 2.1.219. Fails closed — non-zero exit, no silent downgrade — if the version cannot be installed or verified. A bare, unpinned agent name behaves exactly as before.
  • rush cloud run --isolation-tier <shared|isolated> requests a per-tenant isolation boundary (PHNX-3485). isolated gives the run its own namespace with its own resource quota and network policy. Sent only when the flag is set, so an unset flag leaves the dispatch byte-for-byte unchanged against the server default (shared).
  • rush cloud logs -f/--follow. A live run already streams; on a run that has already finished, the durable logs print followed by an explicit note that there is nothing left to follow, instead of exiting as though the stream had ended.
  • rush cloud cancel --reason <text> — printed with the confirmation and sent on the request body — and the command now reports the terminal status the API returns.
  • rush cloud view shows the requested and resolved harness CLI version and the trajectory-capture state when the run reports them; each is omitted when absent.
  • Managed-surface aliases: rush cloud get (for view), and rush cloud login / rush cloud whoami, which reuse the Phoenix ID commands verbatim.
  • rush cloud artifacts <run-id> [name] lists or downloads a finished run's output files (PHNX-3845). A managed run already uploads its artifacts to R2 on completion and the API already served them back — but nothing called those endpoints, so a run's outputs were unreachable from the CLI. With no name it prints the manifest (name, size, type) as a table, browse picker, or --json; with a name it downloads that artifact to a file (default ./<name>, or -o <path> / -o <dir>). Downloads always go to disk, never stdout, since artifacts are arbitrary binary content; a name containing a slash is URL-escaped so it round-trips as a single path segment.

Changed

  • Curated capability and connection manifests moved from data/ to prix/catalog/ (PHNX-3826). This is the source tree rush capability install, rush connection install, and rush skill install read with --from github:muqsitnawaz/agents; their repo-relative roots now resolve under prix/catalog/{capabilities,connections}, and skill discovery walks one level deeper (depth 6) to match the added nesting. The ~/.rush/data/connections home-directory fallback is unchanged.
  • Cloud harness routing derives from a single catalog (PHNX-3860). Three hand-synced maps — alias, wrapper, coding-agent set — collapsed into one spec they are all derived from, so they cannot drift. Behavior-preserving: opencode still dispatches bare, claude/codex still route through their wrapper when unpinned and the bare native ref when pinned.

Fixed

  • rush login persists the refresh token and a real expiry, so a logged-in machine stays logged in (PHNX-3803). The device-token poll returns a Supabase session JWT (roughly 60-minute lifetime) alongside a working refresh token, but login discarded both and stored expires_at: 0 — which the daemon's refresh registry reads as permanently fresh, so it never rotated. The JWT then died server-side about an hour after login and every headless rush cloud run returned 401 until a human re-ran rush login. Both fields are now captured and stored with a real millisecond expiry, and the daemon's existing refresher rotates ahead of it. Supersedes the "no refresh token, and no local expiry" behavior documented under 0.2.38; the opaque-bearer path (no expires_in) still stores expires_at: 0 and is unaffected.
  • A cloud run that ends exited with exit code 0 is reported as success. The factory can observe the native process exit before its poller has durably finalized the run, and the CLI treated that terminal event as a failure. Exit code 0 now prints a clean finish; any other or malformed exit code still fails closed with a non-zero CLI exit.
  • --cloud rejects --sub, --model-all, --var, and --resume instead of silently dropping them. These are registered on the same flag set but have no equivalent in the cloud dispatch body, and the --cloud branch returns before the local code that would use them. rush run agent --sub foo --cloud was accepted and dispatched the root agent, and --resume <session> started a brand-new contextless run rather than continuing the session its own help text promises — both with no error. All four now fail loudly; use rush cloud message to steer an in-flight cloud run.
  • FindSkillDirInRegistry's not-found error no longer cites a stale depth-5 limit after the walk cap moved to 6.

Security

  • Managed cloud runs no longer inherit a human Rush session, and their internal LLM capability is scoped (PHNX-3847). The managed run path is selected only by two explicit, non-secret markers (RUSH_MANAGED_CLOUD_EXECUTION=1 plus a well-formed RUSH_CLOUD_EXECUTION_ID), so a stray RUSH_SESSION_TOKEN, package-install capability, lease credential, or provider key cannot select it. On that path the token in RUSH_SESSION_TOKEN is validated as a capability — issuer prix-cloud-run, audience prix:cloud:llm and nothing else, bound to the execution id — and is cleared from the environment before the runtime starts, with no user.yaml read or write and no daemon self-heal.
  • rush install isolates the package-bootstrap credential (PHNX-3847). A managed install authorizes only the package-key request via RUSH_PACKAGE_INSTALL_TOKEN, which is read and unset before any registry or dependency subprocess can inherit the CLI environment; that narrow bearer is never mistaken for a human session in download tracking. A local install never uses it.
  • BYOK credential redaction is fail-closed (PHNX-3775, PHNX-2689, PHNX-3655). Redaction previously matched a fixed set of key shapes, so a leased credential in an unrecognized format — an opaque or rotated tenant token — passed through verbatim into transcripts and logs, and .shell_history.jsonl was written with raw command, stdout, and stderr. The exact leased value is now registered as a literal at every mint point, both the pod credential helper and the local ResolveBYOKForModel resolver, and scrubbed first regardless of shape; memory writes, log lines, and the shell-history sink all route through it, and a redaction failure drops the line or writes a placeholder rather than emitting the raw value.
  • Pod runs fetch BYOK provider keys just-in-time from the credential-helper socket, scoped by run id and provider, instead of carrying them for the life of the run; a helper miss or error falls back to server-side keys.

Downloads

PlatformBinarySHA-256
macOS · Apple Silicondownload—
macOS · Inteldownload—
Linux · x64download—
Linux · arm64download—
Windows · x64download—
Windows · arm64download—

Checksums are published for the current latest release. Verify older binaries against rush --version after install.