Add code to handle thinking for Alibaba via `/messages`, while still
keeping the code for `/chat/completions`. This way, it keeps working
before and after the migration on Catwalk.

This can happen on edge cases when a models was removed from a provider
on Catwalk on Hyper.

Use the first model in the list instead crashing. This is not critical
to justify preventing Crush to start.

Replace autoReloadDisabled and reloadInProgress boolean guards with a
sync.Mutex (reloadMu) to serialize ReloadFromDisk calls. autoReload
uses TryLock to skip redundant reloads when one is already in progress,
handling both concurrent auto-reloads after parallel writes and
re-entrant calls from configureProviders during a reload.

The autoReload comment now honestly documents the lost-update window:
if a write completes after the in-progress reload has already read the
config file, that change won't appear in memory until the next reload.
Callers needing guaranteed freshness should call ReloadFromDisk.

The load.go RemoveConfigField comment is corrected to explain that
Providers.Del keeps in-memory state consistent, not reload magic.

Also fixes an aliasing bug where append could mutate the package-level
defaultContextPaths slice by cloning it before prepending.

- Sort keys in SetConfigFields before applying sjson.Set for
  deterministic output regardless of map iteration order.
- Remove duplicate os.MkdirAll from atomicWrite (already done in
  lockConfig).
- Rename concurrent test to _concurrentInProcess to accurately reflect
  that it only exercises the in-process mutex, not the cross-process
  flock.

SetExpiresAt no longer silently defaults to 3600s when ExpiresIn is
zero or negative. If ExpiresAt was already set by the provider (some
return exp directly), it is preserved. Otherwise the token is marked
as immediately expired (ExpiresAt=0) so callers are forced to refresh
rather than operating with a guessed lifetime.

Also modernizes IsExpired to use max() for the buffer calculation.

Add runWithUnauthorizedRetry helper that encapsulates the "run → 401
→ refresh credentials → retry" pattern. Migrate all three call sites
(runMessage, Summarize, sub-agent) to use it, preventing the retry
logic from drifting between callers.

Fix a bug in runMessage where the re-authenticate notification fired
unconditionally whenever the original error was a 401, even if the
retry succeeded. Now the notification only fires when the error is
still unauthorized after the retry attempt.

Sub-agents (agent tool, agentic fetch) had no retry logic on 401.
After moving the reauth notification from agent to coordinator,
sub-agent 401s would silently fail with no recovery or user prompt.

Add retry-after-unauthorized matching Run/Summarize, and publish
TypeReAuthenticate if the retry also fails so the user isn't left
with a dead agent and a confusing tool error.

Add 30-second minimum refresh buffer so short-lived tokens always have
a meaningful proactive refresh window. Guard against ExpiresIn=0 in
SetExpiresAt by defaulting to 3600s with a warning, preventing tokens
from being dead on arrival.

Introduce internal/lock as the single file-locking helper for Crush,
replacing the duplicated flock implementations in internal/db and
internal/cmd.

- lock.File(ctx, path) blocks until ctx cancels or lock acquired
  (context-aware deadline replaces hardcoded 5s timeout)
- lock.TryFile(path) returns ErrContended immediately if held
- Migrate internal/db.acquireDataDirLock to lock.TryFile
- Migrate internal/cmd.spawnAndWaitReady to lock.File(cmd.Context(), ...)
  (now respects Ctrl+C during spawn wait)
- Delete internal/db/datadirlock_{unix,windows}.go
- Delete internal/cmd/spawnlock_{other,windows}.go
- Add tests: acquire/release, contention, deadline, cancellation,
  concurrent mutual exclusion

Config store uses lock.File with a 5s context deadline, preserving
existing behavior while gaining context cancellation support.

The agent was publishing TypeReAuthenticate immediately on 401, before
the coordinator had a chance to retry with a refreshed token. This
caused premature reauth popups even when the retry would succeed.

Move the notification to the coordinator so it only fires after
retryAfterUnauthorized fails.

Sets TERM=xterm-256color, GIT_EDITOR=false, EDITOR=false, VISUAL=false,
JJ_EDITOR=false, JJ_PAGER=cat, PAGER=cat, GIT_PAGER=cat for all shell
executions.These are always applied regardless of the caller's environment
to prevent commands from spawning editors or pagers and hanging on a
nonexistent TTY.

Co-authored-by: Kieran Klukas <kieran@dunkirk.sh>

* Closes #3027

This model only work on the Anthropic Messages API.

This fixes premature exits during tool use, hangs after certain
tool-calling stops, and issues when continuing into a session that is
already busy.

Co-Authored-By: Charm Crush <crush@charm.land>

* https://github.com/charmbracelet/fantasy/pull/255

* Follow-up of #3016

When two clients share a session, one client canceling the in flight
turn could return a 500 to the other client whose request was still
open. This makes a canceled run behave as a normal completion.
Cancelations still reach every subscribed client.

Co-Authored-By: Charm Crush <crush@charm.land>

Co-Authored-By: Charm Crush <crush@charm.land>

feat(server): multiplayer

* Capitalize "small" or "large" work (first word)
* Show model display name if available, and only fallback to model ID

The captureDebugLogs function was using a plain bytes.Buffer which is
not safe for concurrent access. When app.New spawns goroutines that log
asynchronously (e.g., mcp.Initialize), the test would read from the
buffer while goroutines were still writing to it, causing a data race.

This change introduces a syncBuffer type that wraps bytes.Buffer with
a mutex, making it safe for concurrent reads and writes.

Display "Yolo mode enabled/disabled" via ReportInfo so the user gets
immediate visual feedback after pressing ctrl+y.

Assisted-by: Crush:claude-opus-4-6

💘 Generated with Crush

Assisted-by: Crush:qwen3.7-max