We were not using the correct format. According to the SPEC it should be:

    Assisted-by: AGENT_NAME:MODEL_VERSION

So now it'll look like this:

    Assisted-by: Crush:kimi-k2.6

See:

https://docs.kernel.org/process/coding-assistants.html#attribution

I keep hitting a bug where a turn finishes -- desktop notification
fires, agent is clearly done -- but the terminal stays stuck on
the spinner with input blocked until something unrelated wakes
the TUI up.

The TUI polls IsSessionBusy() inside its TypeAgentFinished
handler and only re-evaluates on incoming tea.Msgs.  Run() right
now publishes the notification while activeRequests still holds
the session's cancel func, so the poll on receipt sees true and
the busy gates stay stuck.  Reorder so cleanup runs first.

💘 Generated with Crush

Assisted-by: Claude Opus 4.7 via Crush <crush@charm.land>

* Ref https://github.com/charmbracelet/x/pull/853 by @sven2718

Mirrors the view.go sanitizer pattern (filepath.Abs + filepath.Rel +
".." check) so CodeQL no longer flags os.Stat/MkdirAll/OpenFile in the
touch tool as uncontrolled path expressions.

feat(hooks): use embedded shell by default

config: lenient shell expansion default, uniform coverage across MCP, LSP, and providers

fix(config): restore full shell expansion in MCP config values

The assistant message type's toggle-expand method returned no value,
so it silently failed to satisfy the expandable interface and the
keyboard expand path skipped assistant thinking blocks. Expansion
only worked via the mouse, which called the concrete method directly.

Fixing the signature exposed a second bug: the mouse path then
toggled twice per click (once inside the item, once via the generic
interface path), netting no change. The item now just reports
whether the click hit the thinking box; the generic path does the
toggle, gated on that flag so clicks elsewhere do nothing.

Adds a runtime regression test plus a compile-time interface
assertion so this can't silently come back.

Co-authored-by: Crush <crush@charm.land>

When a tool call is made with invalid arguments, Crush will now report
the error back so the model will continue working and can do another
attempt.

Fix on Fantasy done by @mkaaad.

* Ref https://github.com/charmbracelet/crush/issues/2776
* Ref https://github.com/charmbracelet/fantasy/pull/223

`NewBrokerWithOptions` accepted `channelBufferSize` parameter, but never
stored or used it, so `Subsribe`` always used the hardcoded
`bufferSize` constant (64).

Extract `refreshTokenIfExpired` and `retryAfterUnauthorized` functions
to eliminate duplicated OAuth/API key refresh logic in both `Run` and
`Summarize`.

💘 Generated with Crush

Assisted-by: Kimi K2.6 via Crush <crush@charm.land>

When switching from a vision-capable model to one without image support
mid-conversation, historical user messages containing image attachments
would cause API errors. Now those attachments are filtered out from the
prompt history based on the current model's SupportsImages capability.

💘 Generated with Crush

Assisted-by: Kimi K2.6 via Crush <crush@charm.land>