Rush 0.1.0-alpha.48 — Encrypted tokens, and a session that stays put

Your account tokens are encrypted now. Connected-account tokens used to sit as readable text in a file on disk. They now live encrypted in the OS keychain, handled from one guarded place in the app's main process — existing connections keep working with no action needed.

Sign-in stops surprising you. Logging in no longer wipes a session you already had, a network blip no longer bounces you to a re-authentication screen, and the login loop some builds could fall into is gone. When a session really has expired, Rush says so plainly instead of looking logged in while silently failing.

Past sessions replay in full. Opening an old session now shows the complete back-and-forth — sub-agent steps and inline images included — instead of the partial decrypt some builds were stuck on. A long tail of security hardening shipped alongside: updates now check the downloaded bytes against the signed manifest, remote debugging is off in stable builds, and crash reports no longer carry your email.