June 22, 2026

Rush CLI 0.2.20

Name: Rush
Author: Phoenix Horizon, Inc.

Install

macOS / Linux

curl -fsSL https://cdn.getrush.ai/install.sh | bash

Windows

irm https://cdn.getrush.ai/install.ps1 | iex

Homebrew

brew install phnx-labs/tap/rush

Debian / Ubuntu

sudo apt install rush-cli

Already installed?

rush upgrade

macOS Keychain DEK storage. Per-agent DEKs now live only at ~/.rush/keys/{slug}@{version}.key (raw bytes, mode 0600, parent dir 0700). The keychain backend caused 5–10 password prompts per session when running agents with delegation enabled (each InstalledAgentSummaries call hit /usr/bin/security per installed agent, and "Always Allow" was per- keychain-item so it never amortized).

InstalledAgentSummaries() (rush/cli/internal/cli/run.go) now reads slug+description from the metadata DB (~/.rush/metadata.db agents table) instead of decrypting every installed container. Delegate-tool description construction at Becky/Ben startup is now a SQL query, not 24 container decryptions. Falls back to a directory scan for user-created agents not in the DB.
rush/cli/scripts/build.sh no longer passes -tags keyring. The tag selected the macOS Keychain backend (now removed); without it, file storage is the only path.

Existing keychain entries under service com.byphoenix.rush become orphans on first run after upgrade. They cost a few hundred bytes each and can be ignored. First run after upgrade re-fetches one DEK per agent you actually run, from the prix/api registry, and caches to file. Steady state: zero network, zero prompts.

Checksums are published for the current latest release. Verify older binaries against rush --version after install.