The hand-rolled $VARNAME-only resolver (NewEnvironmentVariableResolver)
had no production callers. Tests have been switched to the shell
resolver, which is what production already uses, and the dead type
plus its tests are gone.

Co-Authored-By: Charm Crush <crush@charm.land>

Adds a Shell Expansion section to the skill that covers the
supported syntax, the quiet-unset default, which fields expand
(LSP args and env and MCP url included), that extra_body does not
expand, the empty-header drop rule, and a short security note. The
provider, LSP, and MCP subsections now link to that section instead
of suggesting $ENV_VAR is the only option.

Co-Authored-By: Charm Crush <crush@charm.land>

The godoc on the shell variable resolver still said unset variables
were a hard error. Updated to match the new lenient default and to
point at ${VAR:?message} as the way to require a value.

Co-Authored-By: Charm Crush <crush@charm.land>

Several MCP startup tests were written against the old "unset
variable is an error" behavior and no longer tripped now that
missing variables quietly expand to empty. The fixtures switch to
$(false) or an empty URL so the failing and empty paths are still
covered, and a couple of new subtests pin the new quiet behavior so
it cannot silently regress.

Co-Authored-By: Charm Crush <crush@charm.land>

Updates the README and a handful of struct docs to describe the new
behavior: missing variables expand to empty, ${VAR:?message} is the
way to require a value, empty header values are dropped, extra_body
is a plain JSON passthrough, and crush.json should be treated as
trusted code because any $(...) in it runs at load time with the
user's shell privileges.

Co-Authored-By: Charm Crush <crush@charm.land>

Pins down that a provider with a missing or broken api_key is still
skipped with a warning, now that unset variables quietly expand to
empty instead of erroring. Azure-style api_endpoint is covered the
same way. Tests only, no behavior change.

Co-Authored-By: Charm Crush <crush@charm.land>

LSP args and env values used to be passed to the language server as
raw strings, so "$HOME/go" was sent literally. They now go through
the same shell expansion already used elsewhere in the config. If
expansion fails, that LSP fails to load with a message that points
at the specific arg or env key.

Co-Authored-By: Charm Crush <crush@charm.land>

Provider extra_headers used to log and keep the raw template when a
command inside the header failed. A failing command now stops the
provider from loading, with a clear error that names the provider
and the header.

Headers whose value ends up as an empty string are dropped from the
outgoing request, so "OpenAI-Organization": "$OPENAI_ORG_ID" keeps
working when the variable is not set. MCP headers follow the same
rule.

Co-Authored-By: Charm Crush <crush@charm.land>

Updates tests that assumed missing variables in config values were
an error. They now expect an empty string, matching the new default.
New tests cover ${VAR:?message}, which is the way to still fail
loudly when a variable is required.

Co-Authored-By: Charm Crush <crush@charm.land>

Missing env vars in crush.json used to fail loudly. They now quietly
expand to an empty string, the same as bash. If you want the old
strict behavior for a specific value, write it as ${VAR:?message}
and Crush will still complain when the variable is not set.

Co-Authored-By: Charm Crush <crush@charm.land>

Windows t.TempDir() returns C:\... paths whose backslashes get
consumed as escapes when injected into $(cat ...). Convert to
forward slashes so the embedded shell resolves the path on every OS.

Also accept the Windows coreutils error shape ("cannot find") in
addition to POSIX "exit status" when asserting that inner diagnostic
detail is surfaced — mvdan/sh runs coreutils in-process on Windows
so there is no subprocess exit status to report.

m.URL now runs through the same resolver as command, args, env, and
headers so $VAR / $(cmd) work in http and sse endpoints. The empty-url
guard runs after resolution so ${X:-} still fails cleanly, and failing
expansions surface via the existing StateError path.

Adds MCPConfig.ResolvedArgs and changes ResolvedEnv/ResolvedHeaders to
take a VariableResolver, so createTransport threads one resolver through
command, args, env, and headers. Client mode (IdentityResolver) now
keeps all four fields literal for server-side expansion; server mode
expands uniformly via the shell resolver.

Rewires shellVariableResolver onto the embedded shell interpreter used
by the bash tool and hooks, replacing the hand-rolled parser. Adds a
bounded, scrubbed sanitizeResolveError so resolution failures surface
safely without leaking oversized or non-printable inner stderr.

Groundwork for replacing the hand-rolled parser in internal/config/resolve.go.

Introduces shell.ExpandValue, a single-value expansion entry point built
on mvdan.cc/sh/v3's syntax + expand packages. Runs with nounset on and
globbing off, preserves internal whitespace, strips only trailing
newlines from command substitution output, and bounds/scrubs inner
stderr surfaced in errors. Shares the builtin/block/coreutils handler
chain with NewShell but uses the caller-provided env verbatim.

See: https://github.com/charmbracelet/meta/commit/86917ec06aa42153f5e48cb2570dfc5efd1e389d

No need to set `HYPERCRUSH=1` anymore.

The model was enable to edit `internal/ui/model/ui.go` for me, because
it has ~ 108KB and the limit was 100KB.
(Without being able to read, the model also can't update it).

We're keeping the `fetch` tool limit to 100KB.

Fixes the SSE multi-consumer bug where multiple clients sharing the same
workspace received only a fraction of events (competing-consumer semantics
on a plain channel). Each caller to Events()/SubscribeEvents() now gets
its own dedicated channel via Broker.Subscribe(ctx).

💘 Generated with Crush

Assisted-by: AWS Claude Sonnet 4.6 via Crush <crush@charm.land>

The runner now compiles its own matchers, so a config round-trip can't
silently strip them. Hooks with an invalid matcher are dropped with a
warning instead of quietly matching everything.

A hook with a matcher like "^bash$" was firing on every tool call
after any config write, because the compiled regex was dropped when
the config reloaded. Recompile on reload so filtering keeps working.