June 29, 2026

Rush CLI 0.2.25

Name: Rush
Author: Phoenix Horizon, Inc.

Install

macOS / Linux

curl -fsSL https://cdn.getrush.ai/install.sh | bash

Windows

irm https://cdn.getrush.ai/install.ps1 | iex

Homebrew

brew install phnx-labs/tap/rush

Debian / Ubuntu

sudo apt install rush-cli

Already installed?

rush upgrade

TLS pinning now covers every auth/token HTTP call across the CLI and daemon (RUSH-1263). Six requests used a bare &http.Client{} instead of security.PinnedHTTPClient: rush login's PKCE token exchange, its server-side token check and two Supabase user/developer-flag lookups, the daemon's Supabase session-token refresh, and provider test's BYOK round-trip — all open to MITM with a mis-issued CA cert. All now use the pinned client (verified 2026-06-29 that api.prix.dev and *.supabase.co both chain through the pinned Google Trust Services WE1 intermediate; a dated note and rotation caveat are recorded in transport.go and docs/01-binary-protection.md).
Harness image downscaling now guards against decompression bombs (RUSH-1262). imageops.DecodeFile read the header only via image.DecodeConfig and rejects any image whose declared dimensions exceed a 64 MP cap before image.Decode allocates the bitmap. The 5 MB compressed-size gate alone let a small crafted PNG (e.g. 20000x20000) OOM the process at ~1.6 GB.
Removed the commented-out proxy.WithBYOKResolver(ResolveBYOKForModel) calls so stale Keychain BYOK keys can't be silently re-injected by an uncomment or copy-paste (RUSH-1264). A TODO(RUSH-1251) marks where to re-wire it once the Providers tab is restored.

Checksums are published for the current latest release. Verify older binaries against rush --version after install.