@visual-z/xeno 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # xeno changelog
 
+## 0.7.2 — 2026-10-10
+
+- `/update` now installs the newer release when xeno was installed with bun or npm, instead of only printing the command. The status line shows the target version, elapsed time against a 3-minute limit and the package manager's latest output; success asks for a restart, and a failure gives the reason and the command to run by hand. Automatic checks still never install, and `xeno update --check` still only checks.
+
+## 0.7.1 — 2026-10-09
+
+- Keep a dialog form editable after a validation error. A rejected provider id no longer destroys the input field (`EditBuffer is destroyed`), and the error suggests a valid id.
+- Send the Grok proxy's version-gate header so Grok account inference no longer fails with HTTP 426. A future 426 explains how a xeno user recovers.
+- Show progress, elapsed time and a 3-second limit for a manual `/update` check, with failures styled as errors.
+
 ## 0.7.0 — 2026-10-09
 
 - Keep fullscreen exit output bounded to the execution state and resume command. Preserve full transcript export as an explicit choice.

package/README.md

@@ -17,7 +17,7 @@ is ever summarized by a model, and nothing is ever rewritten in place.
 messages[]                             frozen system prefix + handoff + this node's events
 ```
 
-Version **0.7.0**. The on-disk session format will still change; `0.x` is that
+Version **0.7.2**. The on-disk session format will still change; `0.x` is that
 statement. Published as `@visual-z/xeno`; the license is `UNLICENSED` (readable and installable, no reuse granted).
 
 ## Install
@@ -192,7 +192,7 @@ Slash commands that exist in the session (from `/help`):
 /import <file>     validate and open an archive as an independent session
 /debug [file]      write local terminal and message diagnostics
 /changelog         show bundled release notes
-/update            check now for a newer xeno version without installing
+/update            check for a newer xeno and install it (restart to use)
 /trust [once|here|parent|never]
 /reload            refresh local resources at a durable context checkpoint
 /config            search resources and edit global or project overrides
@@ -479,10 +479,10 @@ unblocking affects new submissions, preserving historical request prefixes.
 - **`/back` does not restore symlinks.**
 - **`.xeno/` is not collected.** Snapshots and abandoned session branches
   stay until you delete them.
-- **No telemetry, `/share`, self-installing updates, or `/compact`.** Those
+- **No telemetry, `/share`, automatic updates, or `/compact`.** Those
   are refusals (`docs/PI_PARITY.md` D15, D16), not backlog. xeno does say
   when a newer version is published, checking automatically at most once a day.
-  `/update` or `xeno update --check` checks immediately without installing;
+  `/update` checks and installs when you ask; `xeno update --check` only checks;
   `docs/install.md` (Updates) lists what that request reveals and every
   way to turn it off.
 

package/docs/install.md

@@ -74,8 +74,9 @@ and restores the terminal. Start inside the intended project or pass
 
 ## Updates
 
-xeno says when a newer version is published. It never installs one: the
-notice names the command, and you run it.
+xeno says when a newer version is published. It never installs one on its
+own: the notice names the command. Typing `/update` is how you ask it to
+install (below).
 
 ```
 xeno 0.4.0 is available (you have 0.3.0)
@@ -87,7 +88,19 @@ The command follows where this copy is installed: `bun add -g` under
 (`…/lib/node_modules/`, or `…\npm\node_modules\` on Windows). Anywhere else
 the notice points to this file. A checkout updates with `git pull`.
 
-To check immediately, type `/update` in the TUI or run:
+To update now, type `/update` in the TUI. It checks the registry and, when
+a newer release exists and xeno was installed with bun or npm, runs the
+command from the notice pinned to that exact version (for example
+`bun add -g @visual-z/xeno@0.7.1`). The status line shows the target version,
+elapsed time against a 3-minute limit, and the package manager's latest output
+line; the editor stays usable. Success says `Updated xeno A → B. Restart xeno
+to use it.` — the running session keeps the old code until you restart. A
+failure says why (exit code or timeout, with the package manager's last lines)
+and repeats the command to run yourself. An unwritable install directory is
+refused before anything runs. Other install locations and checkouts are never
+installed into; they get the notice or `git pull` advice.
+
+To check without installing:
 
 ```sh
 xeno update --check
@@ -98,8 +111,8 @@ automatic-check environment switches, and CI suppression. It reports the
 current version and the result, including a failed query; a stale cache is
 never presented as a successful fresh check. A successful query refreshes
 the same cache used by startup. Repeated checks while a request is running
-share that request. No package is installed and no model credential or
-session is needed for the terminal command.
+share that request. `xeno update --check` never installs, and needs no model
+credential or session.
 
 `--offline` / `XENO_OFFLINE` still prevent network access. Source checkouts
 explain that they update with `git pull` instead of querying npm. Bare

package/docs/providers.md

@@ -25,7 +25,7 @@ xeno 内置 Pi 0.99.1 和 OpenCode 所用 Models.dev 的固定源并集，另加
 
 账户存为 `auth.json` 的 `xai-grok`（0600），模型身份为 `xai-grok/grok-build`，请求走 `https://cli-chat-proxy.grok.com/v1`。`xai` 仍表示 `XAI_API_KEY` 与 `https://api.x.ai/v1`；两个身份不共享凭据或计费账户。也可显式提供 `GROK_ACCESS_TOKEN`，但环境 token 没有 refresh token，不能自动刷新。账户代理地址不能覆盖到其它服务。
 
-采用官方 RFC 8628 设备授权（`https://auth.x.ai/oauth2/device/code` 与 `/oauth2/token`）；只申请推理及刷新所需 scopes，`referrer` 与 User-Agent 标识 xeno。协议所需 `X-XAI-Token-Auth` 与模型路由头遵循官方代理合同。依据：[Grok Build 企业认证](https://docs.x.ai/build/enterprise)、[官方授权源码](https://github.com/xai-org/grok-build/tree/main/crates/codegen/xai-grok-login/src)、[官方代理调用示例](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-shell/README.md)。
+采用官方 RFC 8628 设备授权（`https://auth.x.ai/oauth2/device/code` 与 `/oauth2/token`）；只申请推理及刷新所需 scopes，`referrer` 与 User-Agent 标识 xeno。协议所需 `X-XAI-Token-Auth`、模型路由头与版本闸门头 `x-grok-client-version`（固定为 1.0.46，`x-grok-client-identifier: xeno`）遵循官方代理合同；代理最低版本越过它时返回 426，xeno 会提示更新 xeno 或暂用 `xai` + `XAI_API_KEY`。依据：[Grok Build 企业认证](https://docs.x.ai/build/enterprise)、[官方授权源码](https://github.com/xai-org/grok-build/tree/main/crates/codegen/xai-grok-login/src)、[官方代理调用示例](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-shell/README.md)。
 
 `grok-build` 是官方代理别名，不能把 API 模型的价格、上下文长度或可选 effort 套给它。当前保守暴露文本/工具调用，价格未知、effort 选择关闭；实际账户权限由官方服务决定。设备授权启动已实测返回 200，授权后的推理/刷新有受控 HTTP 验证；没有替用户完成真实账户批准或调用付费模型。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visual-z/xeno",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Segmented append-only agent log with pure context and handoff projections",

package/src/apps/commands.ts

@@ -89,7 +89,7 @@ export const COMMANDS = [
   { name: "import", description: "Import a portable JSONL session", argumentHint: "<file>", busy: "idle" },
   { name: "debug", description: "Write local terminal diagnostics", argumentHint: "[file]", busy: "run" },
   { name: "changelog", description: "Show local release notes", busy: "run" },
-  { name: "update", description: "Check now for a newer xeno version without installing", busy: "run" },
+  { name: "update", description: "Check for a newer xeno and install it; restart to use it", busy: "run" },
   { name: "copy", description: "Copy the last assistant reply", busy: "run" },
   { name: "attachments", description: "Remove images from the current draft", busy: "run" },
   { name: "models", description: "Refresh the model catalog", argumentHint: "<refresh>", busy: "idle" },

package/src/apps/provider-connect.ts

@@ -19,7 +19,7 @@ import type { ModelSpec } from "../runtime/model.ts";
 import { discoverModels, discoveryFamily, likelyChatModel, normalizeBaseUrl, type DiscoveredModel } from "../runtime/model-discovery.ts";
 import { SOURCE_PROVIDERS } from "../runtime/model-data.ts";
 import { applyConnect, applyDisconnect, catalogTwin } from "../runtime/provider-connect.ts";
-import { CUSTOM_PRESETS, presetById, suggestProviderId, validProviderId, type ProviderPreset } from "../runtime/provider-presets.ts";
+import { CUSTOM_PRESETS, presetById, slugProviderId, suggestProviderId, validProviderId, type ProviderPreset } from "../runtime/provider-presets.ts";
 import { providerAccess } from "../runtime/provider-access.ts";
 import { writeAuthFile } from "../store/auth-store.ts";
 import { authPath } from "../store/config.ts";
@@ -154,8 +154,8 @@ function beginPreset(host: ConnectHost, preset: ProviderPreset): void {
         title: `${preset.label} · name`,
         label: "Provider ID",
         value: suggested,
-        hint: "shown in /model as <id>/<model>; lowercase letters, digits, - and _",
-        validate: id => !validProviderId(id) ? "Use lowercase letters, digits, - and _ (start with a letter or digit)"
+        hint: "shown in /model as <id>/<model>; lowercase a-z, digits, - and _",
+        validate: id => !validProviderId(id) ? `Use lowercase a-z, digits, - and _ (no spaces, capitals or non-Latin letters); try "${slugProviderId(id) || suggested}"`
           : SOURCE_PROVIDERS[id] !== undefined ? `"${id}" is a built-in provider; pick another id or choose it from the list` : undefined,
         onSubmit: id => {
           draft.id = id;

package/src/apps/shell.ts

@@ -656,7 +656,7 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
     }
     case "update":
       if (tui) tui.checkForUpdate();
-      else await runManualUpdate({ offline: app.args.offline === true }, app.io.say);
+      else await runManualUpdate({ offline: app.args.offline === true, install: true }, app.io.say);
       return "continue";
     case "copy":
       await copyLastReply(app, tui ?? undefined);

package/src/apps/startup.ts

@@ -1588,7 +1588,7 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [-n|--name name] [--session-id id] [--version|-v]\n" +
           "            [models --refresh]\n" +
           "            [install|remove <source>... [--local]] [update [source] [--extensions]] [list]\n" +
-          "            [update --check]  Check for a newer xeno without installing\n" +
+          "            [update --check]  Check for a newer xeno without installing (/update installs)\n" +
           "            [config [--local]] [--export session [output.html]] [--offline]\n" +
           "            [--system-prompt <text-or-file>] [--append-system-prompt <text>]\n" +
           "            [--no-context-files|-nc]\n" +

package/src/apps/ui/app.ts

@@ -41,6 +41,7 @@ import { SUBSCRIPTION_OPTIONS, subscriptionById, loginGitHubCopilot, startCallba
 import { reportedCost } from "../../runtime/usage.ts";
 import { UpdateChecks } from "../update-check.ts";
 import { updateNotice } from "../../core/update-check.ts";
+import { assertNever } from "../../core/exhaustive.ts";
 import { isUpgrade } from "../../core/version.ts";
 import type { Effort } from "../../runtime/model.ts";
 import { readNode, readCursor, setSessionLabel } from "../../store/log.ts";
@@ -361,9 +362,23 @@ export class InteractiveApp implements Ui {
   checkForUpdate(): void {
     // The explicit action owns its result even when it joins a startup request.
     this.manualUpdateRequested = true;
-    void this.updateChecks.manual({ offline: this.app.args.offline === true }, text => {
-      if (!this.disposed) this.notice(text);
-    }).catch(() => { if (!this.disposed) this.notice("Could not check for xeno updates. Try /update again.", "error"); });
+    void this.updateChecks.manual({ offline: this.app.args.offline === true, install: true }, (text, tone) => {
+      if (!this.disposed) this.notice(text, tone);
+    }, activity => {
+      if (this.disposed) return;
+      switch (activity.state) {
+        case "checking": this.screen.setTransientActivity({ label: `Checking for xeno updates (current ${activity.current})`, timeoutMs: activity.timeoutMs }); break;
+        case "installing": this.screen.setTransientActivity({ label: `Installing xeno ${activity.version}`, timeoutMs: activity.timeoutMs,
+          startedAt: activity.startedAt, ...(activity.detail ? { detail: activity.detail } : {}) }); break;
+        case "idle": this.screen.setTransientActivity(undefined); break;
+        default: assertNever(activity, "manual update activity");
+      }
+    }).catch(() => {
+      if (!this.disposed) {
+        this.screen.setTransientActivity(undefined);
+        this.notice("Could not check for xeno updates. Try /update again.", "error");
+      }
+    });
   }
 
   private emptySession(): boolean {

package/src/apps/update-check.ts

@@ -1,18 +1,31 @@
 /** Shared lifecycle for automatic hints and explicit checks; policy remains in core (D16). */
-import { installKind, manualUpdateResult, updateDisabled, updatePlan, type UpdateInput } from "../core/update-check.ts";
+import { dirname } from "node:path";
+import { installArgv, installKind, installResult, manualUpdateResult, updateDisabled, updatePlan, type UpdateInput } from "../core/update-check.ts";
 import { packageLocation, readUpdateCache, writeUpdateCache } from "../store/update-cache.ts";
-import { fetchLatestVersion } from "../runtime/update-check.ts";
+import { fetchLatestVersion, UPDATE_TIMEOUT_MS } from "../runtime/update-check.ts";
+import { INSTALL_TIMEOUT_MS, runInstall } from "../runtime/self-update.ts";
 import { XENO_VERSION } from "../runtime/oauth.ts";
 
 export interface UpdateOptions {
   readonly offline?: boolean;
   readonly enabled?: boolean | undefined;
+  /** Install a newer release after the check: `/update` does, `xeno update --check` never does. */
+  readonly install?: boolean;
 }
 
+export type ManualUpdateActivity =
+  | { readonly state: "checking"; readonly current: string; readonly timeoutMs: number }
+  | { readonly state: "installing"; readonly version: string; readonly timeoutMs: number; readonly startedAt: number; readonly detail?: string }
+  | { readonly state: "idle" };
+
+type ManualUpdateReporter = (text: string, tone?: "info" | "error") => void;
+
 export class UpdateChecks {
   private readonly controller = new AbortController();
   private pending: Promise<string | null> | undefined;
   private manualTask: Promise<number> | undefined;
+  /** The release this process already installed; the running code stays old until a restart. */
+  private installed: string | undefined;
 
   async prepare(options: UpdateOptions, manual = false) {
     const location = packageLocation();
@@ -36,14 +49,18 @@ export class UpdateChecks {
     return pending;
   }
 
-  manual(options: UpdateOptions, say: (text: string) => void): Promise<number> {
+  manual(options: UpdateOptions, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
     if (this.manualTask) return this.manualTask;
-    const task = this.runManual(options, say).finally(() => { if (this.manualTask === task) this.manualTask = undefined; });
+    const task = this.runManual(options, say, onActivity).finally(() => { if (this.manualTask === task) this.manualTask = undefined; });
     this.manualTask = task;
     return task;
   }
 
-  private async runManual(options: UpdateOptions, say: (text: string) => void): Promise<number> {
+  private async runManual(options: UpdateOptions, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
+    if (options.install && this.installed) {
+      say(`xeno ${this.installed} is already installed. Restart xeno to use it.`);
+      return 0;
+    }
     const { input, plan, disabled } = await this.prepare(options, true);
     if (this.controller.signal.aborted) return 130;
     if (!plan.check) {
@@ -51,12 +68,36 @@ export class UpdateChecks {
         : `Update check skipped: ${disabled ?? "check unavailable"} (xeno ${input.current}).`);
       return input.install === "checkout" ? 0 : 1;
     }
-    say(`Checking for xeno updates (current ${input.current})...`);
-    const latest = await this.refresh(input);
-    if (this.controller.signal.aborted) return 130;
-    const result = manualUpdateResult(latest, input.current, input.install);
-    say(result.text);
-    return result.status === "failed" ? 1 : 0;
+    if (onActivity) onActivity({ state: "checking", current: input.current, timeoutMs: UPDATE_TIMEOUT_MS });
+    else say(`Checking for xeno updates (current ${input.current})...`);
+    try {
+      const latest = await this.refresh(input);
+      if (this.controller.signal.aborted) return 130;
+      const result = manualUpdateResult(latest, input.current, input.install);
+      const argv = options.install && result.status === "available" && latest ? installArgv(input.install, latest) : undefined;
+      if (!argv || !latest) {
+        say(result.text, result.status === "failed" ? "error" : "info");
+        return result.status === "failed" ? 1 : 0;
+      }
+      return await this.install(argv, latest, input.current, say, onActivity);
+    } finally {
+      if (onActivity) onActivity({ state: "idle" });
+    }
+  }
+
+  private async install(argv: readonly string[], latest: string, current: string, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
+    const startedAt = Date.now();
+    if (onActivity) onActivity({ state: "installing", version: latest, timeoutMs: INSTALL_TIMEOUT_MS, startedAt });
+    else say(`Installing xeno ${latest} with ${argv.join(" ")}...`);
+    const outcome = await runInstall(argv, {
+      signal: this.controller.signal, timeoutMs: INSTALL_TIMEOUT_MS, writableDir: dirname(packageLocation().root),
+      ...(onActivity ? { onLine: (detail: string) => onActivity({ state: "installing", version: latest, timeoutMs: INSTALL_TIMEOUT_MS, startedAt, detail }) } : {}),
+    });
+    if (outcome.kind === "cancelled") return 130;
+    const result = installResult(outcome, argv, current, latest);
+    if (result.ok) this.installed = latest;
+    say(result.text, result.ok ? "info" : "error");
+    return result.ok ? 0 : 1;
   }
 
   cancel(): void { this.controller.abort(); }

package/src/core/update-check.ts

@@ -8,6 +8,8 @@
  * environment and the cached answer are all arguments, so every rule is a
  * plain function of its inputs. Explicit checks bypass automatic scheduling
  * and opt-outs, while retaining the offline and source-checkout boundaries.
+ * An explicit `/update` also installs (docs/tasks/fix-update-installs.md):
+ * typing the command is the consent automatic installation never has.
  */
 import { compareVersions, isUpgrade, parseVersion } from "./version.ts";
 
@@ -76,6 +78,44 @@ export function upgradeCommand(install: InstallKind): string | undefined {
   }
 }
 
+/**
+ * What an explicit `/update` runs: the package manager the notice names,
+ * pinned to the version just checked so `latest` cannot move between the
+ * check and the install. Argv, never a shell string. Undefined where xeno
+ * cannot know the right command and only the notice applies.
+ */
+export function installArgv(install: InstallKind, version: string): readonly string[] | undefined {
+  switch (install) {
+    case "bun": return ["bun", "add", "-g", `${PACKAGE_NAME}@${version}`];
+    case "npm": return ["npm", "i", "-g", `${PACKAGE_NAME}@${version}`];
+    case "other": case "checkout": return undefined;
+  }
+}
+
+export type InstallOutcome =
+  | { readonly kind: "installed" }
+  | { readonly kind: "exit"; readonly code: number; readonly output: readonly string[] }
+  | { readonly kind: "timeout"; readonly ms: number; readonly output: readonly string[] }
+  | { readonly kind: "unavailable"; readonly reason: string }
+  | { readonly kind: "cancelled" };
+
+/**
+ * How an install ended, in words a person can act on. A bare exit code hides
+ * ENOTEMPTY and EACCES (codex #5015, #21897), so failures carry the package
+ * manager's last lines and always the command to run by hand.
+ */
+export function installResult(outcome: InstallOutcome, argv: readonly string[], current: string, latest: string): { readonly ok: boolean; readonly text: string } {
+  const manual = `Run it yourself: ${argv.join(" ")}`;
+  const tail = (output: readonly string[]) => output.length ? `\n${output.map(line => `  ${line}`).join("\n")}` : "";
+  switch (outcome.kind) {
+    case "installed": return { ok: true, text: `Updated xeno ${current} → ${latest}. Restart xeno to use it.` };
+    case "exit": return { ok: false, text: `Could not update xeno: ${argv[0]} exited ${outcome.code}.${tail(outcome.output)}\n${manual}` };
+    case "timeout": return { ok: false, text: `Could not update xeno: ${argv[0]} did not finish within ${Math.round(outcome.ms / 1000)}s and was stopped.${tail(outcome.output)}\n${manual}` };
+    case "unavailable": return { ok: false, text: `Could not update xeno: ${outcome.reason}.\n${manual}` };
+    case "cancelled": return { ok: false, text: "xeno update cancelled." };
+  }
+}
+
 /** Two lines: what is new, then the command on its own line so it can be copied whole. */
 export function updateNotice(latest: string, current: string, install: InstallKind): string {
   const command = upgradeCommand(install);

package/src/runtime/oauth.ts

@@ -18,7 +18,7 @@ import { pollDeviceCode } from "./oauth-device.ts";
 import { parseDeviceAuthorization, parseOAuthTokens } from "../core/oauth-fields.ts";
 
 /** Matches package.json. Sent as User-Agent so the server can see who we are (D18). */
-export const XENO_VERSION = "0.7.0";
+export const XENO_VERSION = "0.7.2";
 
 /**
  * Minutes subtracted from server expiry so a request issued at the edge
@@ -114,6 +114,24 @@ export const GROK_PROVIDER = "xai-grok";
 export const GROK_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 /** Official HTTP timeout: issuer requests cannot keep a cancelled or expired grant hanging indefinitely. */
 const GROK_REQUEST_TIMEOUT_MS = 15_000;
+/**
+ * The proxy's version gate reads only `x-grok-client-version`
+ * (grok-build xai-grok-sampler/src/client.rs; agent/proxy_headers.rs: "required
+ * by the proxy's version-gate check"); without it every inference is HTTP 426
+ * "version (none) is outdated". It names the protocol revision xeno speaks,
+ * not xeno's own version -- the User-Agent and client identifier still say
+ * xeno (D18). Pinned, not fetched: a registry lookup would put a network
+ * call in front of every session. 1.0.46 is what CLIProxyAPI and Cherry
+ * Studio send (minimum 1.0.13 as of 2026-10-09; stable 1.0.50). When the
+ * minimum passes it, 426 comes back and grokVersionHint() says so.
+ */
+export const GROK_PROTOCOL_VERSION = "1.0.46";
+/** Shown when the proxy's version gate refuses a request. */
+export function grokVersionHint(status: number | undefined, provider: string): string | undefined {
+  return status === 426 && provider === GROK_PROVIDER
+    ? `the Grok proxy now requires a newer client protocol than xeno sends (${GROK_PROTOCOL_VERSION}); update xeno, or use the xai provider with XAI_API_KEY meanwhile`
+    : undefined;
+}
 
 async function grokPost(url: string, fields: Record<string, string>, effects: Pick<RefreshEffects, "fetch" | "signal">): Promise<{ status: number; json: unknown }> {
   const timeout = AbortSignal.timeout(GROK_REQUEST_TIMEOUT_MS);

package/src/runtime/pi-provider.ts

@@ -17,6 +17,7 @@ import type { AssistantBlock } from "../core/events.ts";
 import { toolCallIdentityViolations, type FrozenPrefix, type Message } from "../core/project.ts";
 import type { Api, ModelSpec } from "./model.ts";
 import { providerRequest } from "./provider-request.ts";
+import { grokVersionHint } from "./oauth.ts";
 import type { ResolveEffects } from "./auth.ts";
 import { imageData } from "./images.ts";
 import { FailedResponseError, type OnDelta, type Provider, type ProviderConfig, type ToolSchema, type Turn } from "./provider.ts";
@@ -373,7 +374,11 @@ export class PiProvider implements Provider {
         case "error":
           if (event.reason === "aborted" || signal?.aborted) throw new DOMException("Request aborted", "AbortError");
           status ??= nativeStatus(event.error.errorMessage ?? "");
-          if (status && status >= 400) throw new HttpError(status, responseHeaders, event.error.errorMessage ?? "Provider request failed");
+          if (status && status >= 400) {
+            // The proxy's own text says "run `grok update`", which a xeno user cannot act on.
+            const hint = grokVersionHint(status, this.config.spec.provider);
+            throw new HttpError(status, responseHeaders, (event.error.errorMessage ?? "Provider request failed") + (hint ? `\n  ${hint}` : ""));
+          }
           throw new StreamError(event.error.errorMessage ?? "Provider stream failed");
         case "start": case "text_start": case "text_end": case "thinking_start": case "thinking_end": break;
         default: assertNever(event, "pi stream event");

package/src/runtime/provider-presets.ts

@@ -74,6 +74,17 @@ export function validProviderId(id: string): boolean {
   return /^[a-z0-9][a-z0-9_-]{0,63}$/.test(id);
 }
 
+/**
+ * The valid id a rejected one most likely meant ("My Gateway" → "my-gateway"),
+ * or "" when nothing Latin survives ("网关"). Only offered in the error, never
+ * applied silently: the id becomes a config and auth.json key the user will
+ * type in /model, so they should see it before it is saved.
+ */
+export function slugProviderId(raw: string): string {
+  if (validProviderId(raw)) return raw;
+  return raw.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[^a-z0-9]+/, "").slice(0, 64).replace(/-+$/, "");
+}
+
 /** A readable default id from a URL host: api.example.com → example. */
 export function suggestProviderId(baseUrl: string, taken: ReadonlySet<string>): string {
   let host = "custom";

package/src/runtime/provider-request.ts

@@ -1,7 +1,7 @@
 import { providerEnvironment, resolveKeyValue, type ResolveEffects } from "./auth.ts";
 import { providerAccess } from "./provider-access.ts";
 import type { ModelSpec } from "./model.ts";
-import { XENO_VERSION, GROK_PROVIDER, GROK_BASE_URL } from "./oauth.ts";
+import { XENO_VERSION, GROK_PROVIDER, GROK_BASE_URL, GROK_PROTOCOL_VERSION } from "./oauth.ts";
 
 const SDK_IDENTITY_HEADERS = ["x-app", "editor-version", "editor-plugin-version", "copilot-integration-id", "http-referer", "x-title"];
 
@@ -45,6 +45,8 @@ export function providerRequest(spec: ModelSpec, key: string, effects: ResolveEf
     // These select the auth protocol and backend; the User-Agent still identifies xeno (D18).
     headers["X-XAI-Token-Auth"] = "xai-grok-cli";
     headers["x-grok-model-override"] = spec.wireId ?? spec.id;
+    headers["x-grok-client-version"] = GROK_PROTOCOL_VERSION;
+    headers["x-grok-client-identifier"] = "xeno";
   }
   const anthropicOAuth = spec.api === "anthropic-messages" && spec.provider !== "github-copilot" && (oauth || key.includes("sk-ant-oat"));
   const noAutomaticAuth = access.auth === false || access.authHeader === false || typeof access.authHeader === "string" || anthropicOAuth;

package/src/runtime/self-update.ts

@@ -0,0 +1,74 @@
+/**
+ * Run the package manager for an explicit `/update` (docs/tasks/fix-update-installs.md).
+ *
+ * The argv comes from core's `installArgv`; this module only owns the process.
+ * Every competitor runs the install unbounded, and that is exactly what their
+ * hang reports are about (claude-code #80147, opencode #10921 `bun add`
+ * stuck forever), so the install has a deadline and streams its latest line
+ * to the caller as evidence that it is moving.
+ */
+import { access, constants } from "node:fs/promises";
+import type { InstallOutcome } from "../core/update-check.ts";
+
+/** A global bun/npm install normally takes seconds; three minutes covers a slow registry. Assumed. */
+export const INSTALL_TIMEOUT_MS = 180_000;
+/** Lines of package-manager output kept for a failure message: enough for an npm error block. */
+const TAIL_LINES = 6;
+
+export interface InstallOptions {
+  readonly signal?: AbortSignal;
+  readonly timeoutMs?: number;
+  /** The package manager's newest non-empty output line. */
+  readonly onLine?: (line: string) => void;
+  /** Refuse before spawning when this directory cannot be written, as pi does. */
+  readonly writableDir?: string;
+}
+
+const ANSI = /\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07]*\x07|\r/g;
+
+export async function runInstall(argv: readonly string[], options: InstallOptions = {}): Promise<InstallOutcome> {
+  if (options.signal?.aborted) return { kind: "cancelled" };
+  if (options.writableDir) {
+    try { await access(options.writableDir, constants.W_OK); }
+    catch { return { kind: "unavailable", reason: `${options.writableDir} is not writable by this user` }; }
+  }
+  // Resolve through PATH like the person's own shell would; a bun-run xeno can always fall back to its own bun.
+  const program = Bun.which(argv[0]!) ?? (argv[0] === "bun" ? process.execPath : null);
+  if (!program) return { kind: "unavailable", reason: `${argv[0]} was not found on PATH` };
+  let child: ReturnType<typeof Bun.spawn<"ignore", "pipe", "pipe">>;
+  try { child = Bun.spawn([program, ...argv.slice(1)], { stdin: "ignore", stdout: "pipe", stderr: "pipe" }); }
+  catch (error) { return { kind: "unavailable", reason: error instanceof Error ? error.message : String(error) }; }
+
+  const output: string[] = [];
+  const read = async (stream: ReadableStream<Uint8Array>) => {
+    const decoder = new TextDecoder();
+    let pending = "";
+    const take = (line: string) => {
+      const clean = line.replace(ANSI, "").trim();
+      if (!clean) return;
+      output.push(clean); if (output.length > TAIL_LINES) output.shift();
+      options.onLine?.(clean);
+    };
+    for await (const chunk of stream) {
+      const lines = (pending + decoder.decode(chunk, { stream: true })).split("\n");
+      pending = lines.pop()!;
+      lines.forEach(take);
+    }
+    take(pending + decoder.decode());
+  };
+
+  let stopped: "timeout" | "cancelled" | undefined;
+  const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
+  const timer = setTimeout(() => { stopped = "timeout"; child.kill(); }, timeoutMs);
+  const abort = () => { stopped ??= "cancelled"; child.kill(); };
+  options.signal?.addEventListener("abort", abort, { once: true });
+  try {
+    const [code] = await Promise.all([child.exited, read(child.stdout), read(child.stderr)]);
+    if (stopped === "timeout") return { kind: "timeout", ms: timeoutMs, output };
+    if (stopped === "cancelled") return { kind: "cancelled" };
+    return code === 0 ? { kind: "installed" } : { kind: "exit", code, output };
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}

package/src/tui/ui/dialog.ts

@@ -40,9 +40,20 @@ export type DialogSpec =
   | { kind: "busy"; title: string; message: string; onCancel?(): void }
   | { kind: "lines"; title: string; render(width: number): string[]; handleKey?(key: KeyPress): boolean | Promise<boolean>; hint?: string; onCancel?(): void };
 
+/**
+ * One stacked dialog. `list` and `row` (a plain form's label + Input) are
+ * persistent: built once, they carry typed text and cursor across repaints,
+ * and `show()` only detaches them. Everything else a repaint builds is
+ * ephemeral and destroyed recursively on the next one, so a persistent node
+ * must never sit inside an ephemeral parent -- that destroyed the form's
+ * Input on the first validation error and every later key threw
+ * (docs/tasks/fix-dialog-form-and-grok-version.md).
+ */
 interface Open {
   spec: DialogSpec;
   list?: ListView;
+  row?: BoxRenderable;
+  label?: TextRenderable;
   input?: InputRenderable;
   secret?: string;
   error?: string | undefined;
@@ -112,6 +123,7 @@ export class DialogHost {
     for (const open of this.stack) {
       open.list?.setColors(colors);
       if (open.input) { open.input.textColor = colors.text; open.input.focusedTextColor = colors.text; open.input.placeholderColor = colors.muted; }
+      if (open.label && open.spec.kind === "form") open.label.content = this.formLabel(open.spec.label);
     }
     if (this.open) this.show();
   }
@@ -180,6 +192,10 @@ export class DialogHost {
         focusedTextColor: this.colors.text, backgroundColor: "transparent", focusedBackgroundColor: "transparent", flexGrow: 1 });
       // Prefilled values are edited from their end (a URL gets a path appended).
       open.input.gotoBufferEnd();
+      open.row = new BoxRenderable(this.renderer, { id: `form-row-${serial++}`, flexDirection: "row", height: 1 });
+      open.label = new TextRenderable(this.renderer, { id: `form-label-${serial++}`, content: this.formLabel(spec.label), flexShrink: 0 });
+      open.row.add(open.label);
+      open.row.add(open.input);
     }
     if (spec.kind === "form" && spec.secret) open.secret = "";
     if (spec.kind === "confirm") open.yes = true;
@@ -228,17 +244,18 @@ export class DialogHost {
       }
       case "form": {
         if (spec.intro?.length) this.add(text(ansiText(spec.intro), { marginBottom: 1 }));
-        const row = new BoxRenderable(this.renderer, { id: `form-row-${serial++}`, flexDirection: "row", height: 1 });
-        row.add(new TextRenderable(this.renderer, { id: `form-label-${serial++}`, content: parts({ text: `${spec.label} › `, fg: c.muted }), flexShrink: 0 }));
-        if (top.input) { row.add(top.input); top.input.focus(); }
+        if (top.row) { this.slot.add(top.row); top.input!.focus(); }
         else {
-          // The secret never reaches a renderable: only its length does.
+          // The secret never reaches a renderable: only its length does. The
+          // whole row is rebuilt per repaint, so it holds nothing persistent.
+          const row = new BoxRenderable(this.renderer, { id: `form-row-${serial++}`, flexDirection: "row", height: 1 });
+          row.add(new TextRenderable(this.renderer, { id: `form-label-${serial++}`, content: this.formLabel(spec.label), flexShrink: 0 }));
           const mask = canvas([[{ text: "•".repeat(Math.min(top.secret!.length, 48)), role: "text" }, { text: "▏", role: "accent" }]]);
           mask.flexGrow = 1;
           row.add(mask);
+          this.add(row);
           this.renderer.currentFocusedRenderable?.blur();
         }
-        this.add(row);
         if (top.error) this.add(text(parts({ text: top.error, fg: c.error })));
         break;
       }
@@ -272,6 +289,8 @@ export class DialogHost {
     this.renderer.requestRender();
   }
 
+  private formLabel(label: string): ReturnType<typeof parts> { return parts({ text: `${label} › `, fg: this.colors.muted }); }
+
   private paintChrome(): void {
     const top = this.stack.at(-1);
     const spec = top?.spec;

package/src/tui/ui/screen.ts

@@ -96,6 +96,7 @@ export class Screen {
   private sidebarWanted = true;
   private status: StatusModel | undefined;
   private dockState: DockState = { model: "", thinking: "", busy: false, activity: "" };
+  private transientActivity: { readonly label: string; readonly startedAt: number; readonly timeoutMs: number; readonly detail?: string } | undefined;
   private home: Greeting | undefined;
   private greetingPlayed = false;
   private greetingFrame = MASCOT_FRAMES;
@@ -348,6 +349,13 @@ export class Screen {
     this.paintEdges();
   }
 
+  /** `startedAt` keeps the elapsed clock running when a long activity only refreshes its detail line. */
+  setTransientActivity(activity: { readonly label: string; readonly timeoutMs: number; readonly startedAt?: number; readonly detail?: string } | undefined): void {
+    this.transientActivity = activity ? { ...activity, startedAt: activity.startedAt ?? Date.now() } : undefined;
+    this.syncActivity();
+    this.paintEdges();
+  }
+
   private paintEdges(): void {
     const width = Math.max(2, this.renderer.width - (this.shape.tier === "sidebar" ? this.shape.sidebarWidth : 0) - 2);
     const d = this.dockState, dialog = this.dialogs.open;
@@ -371,8 +379,11 @@ export class Screen {
       const seconds = Math.max(0, Math.floor((Date.now() - this.busySince) / 1000));
       const activity = this.status?.activity;
       const label = activity ? `${activity.label}${activity.label === "Running tool" || activity.label === "Retrying" ? ` · ${activity.detail}` : ""}${activity.queued ? ` · ${activity.queued} queued` : ""}` : d.activity;
-      left = [{ segs: [{ text: "●", role: "accent", spin: activity?.state !== "blocked" }, { text: ` ${label}`, role: activity?.state === "blocked" ? "warning" : "muted" }, { text: ` ${seconds}s`, role: "muted" }], priority: 0, min: 1, shrink: 1 }];
+      const transient = this.transientActivity ? ` · ${this.transientActivityText()}` : "";
+      left = [{ segs: [{ text: "●", role: "accent", spin: activity?.state !== "blocked" }, { text: ` ${label}${transient}`, role: activity?.state === "blocked" ? "warning" : "muted" }, { text: ` ${seconds}s`, role: "muted" }], priority: 0, min: 1, shrink: 1 }];
       right.push({ segs: [{ text: "esc interrupt", role: "muted" }], priority: 4 });
+    } else if (this.transientActivity) {
+      left = [{ segs: [{ text: "●", role: "accent", spin: true }, { text: ` ${this.transientActivityText()}`, role: "muted" }], priority: 0, min: 1, shrink: 1 }];
     } else {
       // A draft taller than the box says what scrolled out of view (fix-tui-composer-growth DoD 4).
       const { above, below } = this.composer.overflow;
@@ -397,7 +408,7 @@ export class Screen {
 
   /** The clock runs only while something on screen shows the activity glyph. */
   private syncActivity(): void {
-    const wanted = this.animations && (this.dockState.busy || this.dialogs.animated);
+    const wanted = this.animations && (this.dockState.busy || this.transientActivity !== undefined || this.dialogs.animated);
     if (wanted && !this.activity.running) { this.lastEvent = Date.now(); this.startClock(ACTIVITY_MS); }
     else if (!wanted && this.activity.running) { this.activity.stop(); this.paintEdges(); }
   }
@@ -413,6 +424,13 @@ export class Screen {
     }, undefined, intervalMs);
   }
 
+  private transientActivityText(): string {
+    const activity = this.transientActivity!;
+    const elapsed = Math.max(0, Math.floor((Date.now() - activity.startedAt) / 1000));
+    const deadline = Math.max(1, Math.ceil(activity.timeoutMs / 1000));
+    return `${activity.label} · ${elapsed}s / ${deadline}s max${activity.detail ? ` · ${activity.detail}` : ""}`;
+  }
+
   /** The spinner's current interval (tests). */
   get activityInterval(): number { return this.activity.running ? this.activityMs : 0; }