zelari-code 0.1.2 → 0.2.0

package/dist/cli/main.bundled.js

@@ -10,276 +10,71 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/cli/oauthCallbackServer.ts
-import { createServer } from "node:http";
-function startOAuthCallbackServer(options = {}) {
-  const host = options.host ?? "127.0.0.1";
-  const preferredPort = options.port ?? 14523;
-  const timeoutMs = options.timeoutMs ?? 6e4;
-  const expectedPath = options.expectedPath ?? "/oauth/callback";
-  const successHtml = options.successHtml ?? DEFAULT_SUCCESS_HTML;
-  return new Promise((resolveStart, rejectStart) => {
-    let resolved = false;
-    let resolveCode = null;
-    let rejectCode = null;
-    let timeoutHandle = null;
-    const server = createServer((req, res) => {
-      try {
-        if (!req.url) {
-          res.writeHead(400, { "Content-Type": "text/plain" });
-          res.end("Bad request");
-          return;
-        }
-        const url2 = new URL(req.url, `http://${host}:${preferredPort}`);
-        if (url2.pathname !== expectedPath) {
-          res.writeHead(404, { "Content-Type": "text/plain" });
-          res.end("Not found");
-          return;
-        }
-        const code = url2.searchParams.get("code");
-        const state = url2.searchParams.get("state");
-        const errorParam = url2.searchParams.get("error");
-        const errorDescription = url2.searchParams.get("error_description");
-        const extras = {};
-        for (const [key, value] of url2.searchParams.entries()) {
-          if (key !== "code" && key !== "state" && key !== "error" && key !== "error_description") {
-            extras[key] = value;
-          }
-        }
-        const params = {
-          ...code ? { code } : {},
-          ...state ? { state } : {},
-          ...errorParam ? { error: errorParam } : {},
-          ...errorDescription ? { errorDescription } : {},
-          extras
-        };
-        if (errorParam) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(`<h1>OAuth error: ${errorParam}</h1>`);
-          if (rejectCode && !resolved) {
-            resolved = true;
-            if (timeoutHandle) clearTimeout(timeoutHandle);
-            rejectCode(new OAuthCallbackError(`OAuth provider returned error: ${errorParam}`));
-          }
-          return;
-        }
-        if (!code) {
-          res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-          res.end("<h1>Missing <code>code</code> query parameter</h1>");
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(successHtml);
-        if (resolveCode && !resolved) {
-          resolved = true;
-          if (timeoutHandle) clearTimeout(timeoutHandle);
-          resolveCode(params);
-        }
-        setTimeout(() => {
-          try {
-            server.close();
-          } catch {
-          }
-        }, 100);
-      } catch (err) {
-        try {
-          res.writeHead(500, { "Content-Type": "text/plain" });
-          res.end("Internal error");
-        } catch {
-        }
-        if (!resolved && rejectCode) {
-          resolved = true;
-          if (timeoutHandle) clearTimeout(timeoutHandle);
-          rejectCode(err instanceof Error ? err : new Error(String(err)));
-        }
-      }
-    });
-    const onError = (err) => {
-      if (!resolved) {
-        resolved = true;
-        if (timeoutHandle) clearTimeout(timeoutHandle);
-        rejectStart(err);
-      }
-    };
-    server.once("error", onError);
-    server.listen(preferredPort, host, () => {
-      const addr = server.address();
-      const actualPort = addr ? addr.port : preferredPort;
-      const waitForCode = () => {
-        return new Promise((res, rej) => {
-          if (resolved) {
-            rej(new OAuthCallbackClosedError());
-            return;
-          }
-          resolveCode = res;
-          rejectCode = rej;
-          timeoutHandle = setTimeout(() => {
-            if (!resolved) {
-              resolved = true;
-              try {
-                server.close();
-              } catch {
-              }
-              rej(new OAuthCallbackTimeoutError(timeoutMs));
-            }
-          }, timeoutMs);
-          if (typeof timeoutHandle?.unref === "function") timeoutHandle.unref();
-        });
-      };
-      const close = () => {
-        if (timeoutHandle) clearTimeout(timeoutHandle);
-        try {
-          server.close();
-        } catch {
-        }
-        if (!resolved && rejectCode) {
-          resolved = true;
-          rejectCode(new OAuthCallbackClosedError());
-        }
-      };
-      resolveStart({ port: actualPort, waitForCode, close });
-    });
-  });
-}
-var DEFAULT_SUCCESS_HTML, OAuthCallbackTimeoutError, OAuthCallbackClosedError, OAuthCallbackError;
-var init_oauthCallbackServer = __esm({
-  "src/cli/oauthCallbackServer.ts"() {
-    "use strict";
-    DEFAULT_SUCCESS_HTML = `
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <title>zelari-code OAuth</title>
-</head>
-<body style="font-family: -apple-system, BlinkMacSystemFont, sans-serif; padding: 40px; text-align: center; color: #1a1a1a;">
-  <h1 style="color: #00aa33;">\u2713 Authentication complete</h1>
-  <p>You can close this tab and return to zelari-code.</p>
-</body>
-</html>
-`.trim();
-    OAuthCallbackTimeoutError = class extends Error {
-      constructor(timeoutMs) {
-        super(`OAuth callback not received within ${timeoutMs}ms`);
-        this.name = "OAuthCallbackTimeoutError";
-      }
-    };
-    OAuthCallbackClosedError = class extends Error {
-      constructor() {
-        super("OAuth callback server closed before receiving a callback");
-        this.name = "OAuthCallbackClosedError";
-      }
-    };
-    OAuthCallbackError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "OAuthCallbackError";
-      }
-    };
-  }
-});
-
 // src/cli/grokOAuth.ts
-import nodeCrypto from "node:crypto";
-async function fetchGrokDiscovery(options = {}) {
+async function requestDeviceCode(options) {
   const fetchImpl = options.fetchImpl ?? fetch;
-  const discoveryUrl = options.discoveryUrl ?? `${options.issuer ?? DEFAULT_GROK_OAUTH_ISSUER}/.well-known/openid-configuration`;
-  let response;
-  try {
-    response = await fetchImpl(discoveryUrl, { method: "GET", headers: { Accept: "application/json" } });
-  } catch (err) {
-    throw new GrokOAuthError(`OAuth discovery network error: ${err instanceof Error ? err.message : String(err)}`, "discovery_network_error");
-  }
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    throw new GrokOAuthError(
-      `OAuth discovery HTTP ${response.status}: ${text.slice(0, 200)}`,
-      `discovery_http_${response.status}`
-    );
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch (err) {
-    throw new GrokOAuthError(`OAuth discovery returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (!body || typeof body !== "object") {
-    throw new GrokOAuthError("OAuth discovery returned non-object body");
-  }
-  const obj = body;
-  if (typeof obj.authorization_endpoint !== "string" || typeof obj.token_endpoint !== "string") {
-    throw new GrokOAuthError("OAuth discovery missing authorization_endpoint or token_endpoint");
-  }
-  return {
-    authorizationEndpoint: obj.authorization_endpoint,
-    tokenEndpoint: obj.token_endpoint
-  };
-}
-function generatePkce() {
-  const random = getRandomValues(new Uint8Array(64));
-  const verifier = Buffer.from(random).toString("base64url").slice(0, 128);
-  const hash2 = createHash("sha256").update(verifier).digest();
-  const challenge = hash2.toString("base64url").replace(/=+$/, "");
-  return { verifier, challenge };
-}
-function buildGrokAuthorizeUrl(options) {
+  const endpoint = options.deviceCodeEndpoint ?? DEFAULT_DEVICE_CODE_ENDPOINT;
   const scopes = options.scopes ?? DEFAULT_GROK_OAUTH_SCOPES;
-  const params = new URLSearchParams({
-    client_id: options.clientId,
-    redirect_uri: options.redirectUri,
-    response_type: "code",
-    scope: scopes.join(" "),
-    state: options.state ?? crypto.randomUUID(),
-    code_challenge: options.codeChallenge,
-    code_challenge_method: "S256"
-  });
-  return `${options.authorizeEndpoint}?${params.toString()}`;
-}
-async function exchangeGrokCode(options) {
-  const fetchImpl = options.fetchImpl ?? fetch;
   let response;
   try {
-    response = await fetchImpl(options.tokenEndpoint, {
+    response = await fetchImpl(endpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
         Accept: "application/json"
       },
       body: new URLSearchParams({
-        grant_type: "authorization_code",
         client_id: options.clientId,
-        code: options.code,
-        redirect_uri: options.redirectUri,
-        code_verifier: options.codeVerifier
+        scope: scopes.join(" ")
       }).toString()
     });
   } catch (err) {
-    throw new GrokOAuthError(`Token exchange network error: ${err instanceof Error ? err.message : String(err)}`);
+    throw new GrokOAuthError(
+      `Device code request network error: ${err instanceof Error ? err.message : String(err)}`,
+      "device_code_network_error"
+    );
   }
   if (!response.ok) {
     const errText = await response.text().catch(() => "");
     throw new GrokOAuthError(
-      `Token exchange HTTP ${response.status}: ${errText.slice(0, 200)}`,
-      `http_${response.status}`
+      `Device code request HTTP ${response.status}: ${errText.slice(0, 200)}`,
+      `device_code_http_${response.status}`
     );
   }
   let body;
   try {
     body = await response.json();
   } catch (err) {
-    throw new GrokOAuthError(`Token exchange returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    throw new GrokOAuthError(
+      `Device code response invalid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
   if (!body || typeof body !== "object") {
-    throw new GrokOAuthError("Token exchange returned non-object body");
+    throw new GrokOAuthError("Device code response is not an object");
   }
   const obj = body;
-  const accessToken = obj.access_token;
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new GrokOAuthError("Token exchange response missing access_token", "no_access_token");
+  const deviceCode = obj.device_code;
+  const userCode = obj.user_code;
+  const verificationUri = obj.verification_uri;
+  if (typeof deviceCode !== "string" || deviceCode.length === 0) {
+    throw new GrokOAuthError("Device code response missing device_code", "no_device_code");
   }
-  return parseTokenResponseBody(obj, accessToken, "Token exchange");
+  if (typeof userCode !== "string" || userCode.length === 0) {
+    throw new GrokOAuthError("Device code response missing user_code", "no_user_code");
+  }
+  if (typeof verificationUri !== "string" || verificationUri.length === 0) {
+    throw new GrokOAuthError("Device code response missing verification_uri", "no_verification_uri");
+  }
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...typeof obj.verification_uri_complete === "string" && obj.verification_uri_complete.length > 0 ? { verificationUriComplete: obj.verification_uri_complete } : {},
+    expiresIn: typeof obj.expires_in === "number" && Number.isFinite(obj.expires_in) ? obj.expires_in : 1800,
+    interval: typeof obj.interval === "number" && Number.isFinite(obj.interval) ? obj.interval : 5
+  };
 }
-function parseTokenResponseBody(obj, accessToken, label) {
+function parseTokenResponseBody(obj, accessToken) {
   const result = { accessToken };
   if (typeof obj.expires_in === "number" && Number.isFinite(obj.expires_in)) {
     result.expiresAt = Date.now() + obj.expires_in * 1e3;
@@ -292,6 +87,116 @@ function parseTokenResponseBody(obj, accessToken, label) {
   }
   return result;
 }
+async function pollForDeviceToken(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const sleep = options.sleepImpl ?? defaultSleep;
+  const endpoint = options.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+  const deadline = Date.now() + options.timeoutMs;
+  let interval = Math.max(options.interval, 1);
+  while (true) {
+    if (Date.now() >= deadline) {
+      throw new GrokOAuthError("Device authorization timed out waiting for user approval", "timeout");
+    }
+    let response;
+    try {
+      response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: DEVICE_GRANT_TYPE,
+          client_id: options.clientId,
+          device_code: options.deviceCode
+        }).toString()
+      });
+    } catch (err) {
+      throw new GrokOAuthError(
+        `Token poll network error: ${err instanceof Error ? err.message : String(err)}`,
+        "poll_network_error"
+      );
+    }
+    if (response.ok) {
+      let body;
+      try {
+        body = await response.json();
+      } catch (err) {
+        throw new GrokOAuthError(
+          `Token response invalid JSON: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      if (!body || typeof body !== "object") {
+        throw new GrokOAuthError("Token response is not an object");
+      }
+      const obj = body;
+      const accessToken = obj.access_token;
+      if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new GrokOAuthError("Token response missing access_token", "no_access_token");
+      }
+      return parseTokenResponseBody(obj, accessToken);
+    }
+    let errBody = {};
+    try {
+      const parsed = await response.json();
+      if (parsed && typeof parsed === "object") errBody = parsed;
+    } catch {
+    }
+    const errorCode = typeof errBody.error === "string" ? errBody.error : `http_${response.status}`;
+    switch (errorCode) {
+      case "authorization_pending":
+        await sleep(interval * 1e3);
+        continue;
+      case "slow_down":
+        interval += 5;
+        await sleep(interval * 1e3);
+        continue;
+      case "expired_token":
+      case "expired":
+        throw new GrokOAuthError("Device code expired before user authorized", "expired");
+      case "access_denied":
+      case "denied":
+        throw new GrokOAuthError("User denied the authorization request", "denied");
+      case "invalid_grant":
+        throw new GrokOAuthError("Device code rejected (invalid_grant)", "invalid_grant");
+      default:
+        throw new GrokOAuthError(
+          `Token poll error: ${errorCode}${typeof errBody.error_description === "string" ? ` \u2014 ${errBody.error_description}` : ""}`,
+          errorCode
+        );
+    }
+  }
+}
+async function runGrokOAuthFlow(options = {}) {
+  const clientId = options.clientId || process.env.GROK_OAUTH_CLIENT_ID || DEFAULT_GROK_OAUTH_CLIENT_ID;
+  if (!clientId || clientId.trim().length === 0) {
+    throw new GrokOAuthError("Missing clientId", "no_client_id");
+  }
+  const deviceAuth = await requestDeviceCode({
+    clientId,
+    scopes: options.scopes,
+    deviceCodeEndpoint: options.deviceCodeEndpoint,
+    fetchImpl: options.fetchImpl
+  });
+  if (options.onUserCode) {
+    await options.onUserCode(deviceAuth);
+  }
+  try {
+    await openBrowser(deviceAuth.verificationUriComplete ?? deviceAuth.verificationUri);
+  } catch {
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_OAUTH_TIMEOUT_MS;
+  const effectiveTimeout = Math.min(timeoutMs, deviceAuth.expiresIn * 1e3);
+  return pollForDeviceToken({
+    clientId,
+    deviceCode: deviceAuth.deviceCode,
+    interval: deviceAuth.interval,
+    timeoutMs: effectiveTimeout,
+    tokenEndpoint: options.tokenEndpoint,
+    fetchImpl: options.fetchImpl,
+    sleepImpl: options.sleepImpl
+  });
+}
 async function refreshGrokToken(options) {
   if (!options.clientId || options.clientId.trim().length === 0) {
     throw new GrokOAuthError("Missing clientId", "no_client_id");
@@ -299,7 +204,7 @@ async function refreshGrokToken(options) {
   if (!options.refreshToken || options.refreshToken.trim().length === 0) {
     throw new GrokOAuthError("Missing refreshToken", "no_refresh_token");
   }
-  const endpoint = options.tokenEndpoint ?? "https://oauth.x.ai/token";
+  const endpoint = options.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
   const fetchImpl = options.fetchImpl ?? fetch;
   let response;
   try {
@@ -340,77 +245,7 @@ async function refreshGrokToken(options) {
   if (typeof accessToken !== "string" || accessToken.length === 0) {
     throw new GrokOAuthError("Token refresh response missing access_token", "no_access_token");
   }
-  return parseTokenResponseBody(obj, accessToken, "Token refresh");
-}
-async function runGrokOAuthFlow(options) {
-  const clientId = options.clientId || process.env.GROK_OAUTH_CLIENT_ID || DEFAULT_GROK_OAUTH_CLIENT_ID;
-  if (!clientId || clientId.trim().length === 0) {
-    throw new GrokOAuthError("Missing clientId", "no_client_id");
-  }
-  const callbackPort = options.callbackPort ?? DEFAULT_GROK_OAUTH_REDIRECT_PORT;
-  const callbackPath = options.callbackPath ?? DEFAULT_GROK_OAUTH_REDIRECT_PATH;
-  const redirectUri = `http://127.0.0.1:${callbackPort}${callbackPath}`;
-  const discovery = await fetchGrokDiscovery({
-    issuer: options.issuer,
-    discoveryUrl: options.discoveryUrl,
-    fetchImpl: options.fetchImpl
-  });
-  const { verifier: codeVerifier, challenge: codeChallenge } = generatePkce();
-  const state = crypto.randomUUID();
-  const authorizeUrl = buildGrokAuthorizeUrl({
-    clientId,
-    redirectUri,
-    scopes: options.scopes,
-    state,
-    codeChallenge,
-    authorizeEndpoint: discovery.authorizationEndpoint
-  });
-  let handle;
-  try {
-    handle = await startOAuthCallbackServer({
-      port: callbackPort,
-      timeoutMs: options.callbackTimeoutMs ?? 12e4,
-      expectedPath: callbackPath
-    });
-  } catch (err) {
-    throw new GrokOAuthError(
-      `Failed to start OAuth callback server on port ${callbackPort}: ${err instanceof Error ? err.message : String(err)}`,
-      "callback_bind_failed"
-    );
-  }
-  try {
-    if (options.onBrowserOpen) {
-      await options.onBrowserOpen(authorizeUrl);
-    } else {
-      await openBrowser(authorizeUrl);
-    }
-    const callbackResult = await handle.waitForCode();
-    if (callbackResult.state !== state) {
-      throw new GrokOAuthError(
-        `OAuth state mismatch \u2014 possible CSRF. expected=${state} got=${callbackResult.state ?? "(none)"}`,
-        "state_mismatch"
-      );
-    }
-    if (callbackResult.error) {
-      throw new GrokOAuthError(
-        `OAuth provider returned error: ${callbackResult.error}${callbackResult.errorDescription ? ` \u2014 ${callbackResult.errorDescription}` : ""}`,
-        callbackResult.error
-      );
-    }
-    if (!callbackResult.code) {
-      throw new GrokOAuthError("OAuth callback did not include authorization code", "no_code");
-    }
-    return await exchangeGrokCode({
-      clientId,
-      code: callbackResult.code,
-      codeVerifier,
-      redirectUri,
-      tokenEndpoint: discovery.tokenEndpoint,
-      fetchImpl: options.fetchImpl
-    });
-  } finally {
-    handle.close();
-  }
+  return parseTokenResponseBody(obj, accessToken);
 }
 async function openBrowser(url2) {
   const { spawn: spawn3 } = await import("node:child_process");
@@ -438,12 +273,10 @@ async function openBrowser(url2) {
     }
   });
 }
-var getRandomValues, createHash, GrokOAuthError, DEFAULT_GROK_OAUTH_CLIENT_ID, DEFAULT_GROK_OAUTH_ISSUER, DEFAULT_GROK_OAUTH_SCOPES, DEFAULT_GROK_OAUTH_REDIRECT_PORT, DEFAULT_GROK_OAUTH_REDIRECT_PATH;
+var GrokOAuthError, DEFAULT_GROK_OAUTH_CLIENT_ID, DEFAULT_GROK_OAUTH_SCOPES, DEFAULT_DEVICE_CODE_ENDPOINT, DEFAULT_TOKEN_ENDPOINT, DEVICE_GRANT_TYPE, DEFAULT_OAUTH_TIMEOUT_MS, defaultSleep;
 var init_grokOAuth = __esm({
   "src/cli/grokOAuth.ts"() {
     "use strict";
-    init_oauthCallbackServer();
-    ({ getRandomValues, createHash } = nodeCrypto);
     GrokOAuthError = class extends Error {
       constructor(message, code) {
         super(message);
@@ -452,7 +285,6 @@ var init_grokOAuth = __esm({
       }
     };
     DEFAULT_GROK_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
-    DEFAULT_GROK_OAUTH_ISSUER = "https://auth.x.ai";
     DEFAULT_GROK_OAUTH_SCOPES = [
       "openid",
       "profile",
@@ -461,8 +293,11 @@ var init_grokOAuth = __esm({
       "grok-cli:access",
       "api:access"
     ];
-    DEFAULT_GROK_OAUTH_REDIRECT_PORT = 56121;
-    DEFAULT_GROK_OAUTH_REDIRECT_PATH = "/callback";
+    DEFAULT_DEVICE_CODE_ENDPOINT = "https://auth.x.ai/oauth2/device/code";
+    DEFAULT_TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
+    DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+    DEFAULT_OAUTH_TIMEOUT_MS = 3e5;
+    defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
   }
 });
 
@@ -688,11 +523,11 @@ __export(updater_exports, {
 });
 import { createRequire } from "node:module";
 import { spawn as spawn2 } from "node:child_process";
-import path15 from "node:path";
+import path16 from "node:path";
 import { fileURLToPath } from "node:url";
 function getCurrentVersion() {
   try {
-    const pkgPath = path15.resolve(__dirname2, "..", "..", "package.json");
+    const pkgPath = path16.resolve(__dirname2, "..", "..", "package.json");
     const pkg = require2(pkgPath);
     return pkg.version;
   } catch {
@@ -791,7 +626,7 @@ var init_updater = __esm({
   "src/cli/updater.ts"() {
     "use strict";
     require2 = createRequire(import.meta.url);
-    __dirname2 = path15.dirname(fileURLToPath(import.meta.url));
+    __dirname2 = path16.dirname(fileURLToPath(import.meta.url));
     REGISTRY_URL = "https://registry.npmjs.org/zelari-code/latest";
   }
 });
@@ -2014,6 +1849,41 @@ var AgentHarness = class {
     });
     this.emit(initialMsgEnd);
     yield initialMsgEnd;
+    const MAX_TOOL_LOOP_ITERATIONS = 12;
+    let toolLoopTurns = 0;
+    while (!this.cancelled && !hadError && toolLoopTurns < MAX_TOOL_LOOP_ITERATIONS && initialFinishRef.value === "tool_calls") {
+      toolLoopTurns++;
+      const turnMessageId = crypto.randomUUID();
+      const msgStart = createBrainEvent(
+        "message_start",
+        this.sessionId,
+        { messageId: turnMessageId, role: "assistant" }
+      );
+      this.emit(msgStart);
+      yield msgStart;
+      let turnLength = 0;
+      const turnFinishRef = { value: "stop" };
+      const turnUsageRef = { value: null };
+      for await (const ev of this.runSingleTurn(turnMessageId, turnFinishRef, turnUsageRef)) {
+        if (ev.type === "message_delta") {
+          turnLength += ev.delta.length;
+        } else if (ev.type === "error") {
+          if (ev.severity !== "cancelled") hadError = true;
+        }
+        yield ev;
+      }
+      totalLength += turnLength;
+      const msgEnd = createBrainEvent("message_end", this.sessionId, {
+        messageId: turnMessageId,
+        totalLength: turnLength,
+        finishReason: turnFinishRef.value,
+        ...turnUsageRef.value ? { usage: turnUsageRef.value } : {}
+      });
+      this.emit(msgEnd);
+      yield msgEnd;
+      initialFinishRef.value = turnFinishRef.value;
+      if (hadError || this.cancelled) break;
+    }
     let turns = 0;
     while (turns < this.maxQueuedIterations) {
       if (this.cancelled) break;
@@ -2084,6 +1954,8 @@ var AgentHarness = class {
       });
       let toolCallsThisTurn = 0;
       const maxToolCalls = this.config.maxToolCallsPerTurn;
+      let turnText = "";
+      const turnToolCalls = [];
       for await (const delta of stream) {
         if (this.cancelled) {
           const cancelEvent = createBrainEvent("error", this.sessionId, {
@@ -2096,6 +1968,7 @@ var AgentHarness = class {
           break;
         }
         if (delta.kind === "text") {
+          turnText += delta.delta;
           const deltaEvent = createBrainEvent(
             "message_delta",
             this.sessionId,
@@ -2112,6 +1985,7 @@ var AgentHarness = class {
           yield thinkEvent;
         } else if (delta.kind === "tool_call") {
           toolCallsThisTurn++;
+          turnToolCalls.push({ id: delta.toolCallId, name: delta.toolName, args: delta.args });
           const toolStartEvent = createBrainEvent("tool_execution_start", this.sessionId, {
             toolCallId: delta.toolCallId,
             toolName: delta.toolName,
@@ -2131,18 +2005,24 @@ var AgentHarness = class {
                 signal: this.activeController?.signal
               }
             );
+            const resultStr = result.ok ? String(result.value) : result.error;
             const endEvent = createBrainEvent(
               "tool_execution_end",
               this.sessionId,
               {
                 toolCallId: delta.toolCallId,
-                result: result.ok ? String(result.value) : result.error,
+                result: resultStr,
                 isError: !result.ok,
                 durationMs: Date.now() - startMs
               }
             );
             this.emit(endEvent);
             yield endEvent;
+            this.config.messages.push({
+              role: "tool",
+              toolCallId: delta.toolCallId,
+              content: resultStr
+            });
           } else if (skipped) {
             const endEvent = createBrainEvent(
               "tool_execution_end",
@@ -2156,9 +2036,21 @@ var AgentHarness = class {
             );
             this.emit(endEvent);
             yield endEvent;
+            this.config.messages.push({
+              role: "tool",
+              toolCallId: delta.toolCallId,
+              content: `[skipped] maxToolCallsPerTurn reached (limit=${maxToolCalls})`
+            });
           }
         } else if (delta.kind === "finish") {
           finishRef.value = delta.reason;
+          if (turnToolCalls.length > 0 || turnText.length > 0) {
+            this.config.messages.push({
+              role: "assistant",
+              content: turnText,
+              ...turnToolCalls.length > 0 ? { toolCalls: turnToolCalls } : {}
+            });
+          }
           break;
         } else if (delta.kind === "error") {
           const errEvent = createBrainEvent("error", this.sessionId, {
@@ -2410,9 +2302,33 @@ function resolveBaseUrl(providerId) {
 }
 function openaiCompatibleProvider(config2) {
   return async function* (params) {
+    const messages = params.messages.map((m) => {
+      if (m.role === "tool") {
+        return {
+          role: "tool",
+          tool_call_id: m.toolCallId,
+          content: m.content
+        };
+      }
+      if (m.role === "assistant" && m.toolCalls && m.toolCalls.length > 0) {
+        return {
+          role: "assistant",
+          content: m.content ?? "",
+          tool_calls: m.toolCalls.map((tc) => ({
+            id: tc.id,
+            type: "function",
+            function: {
+              name: tc.name,
+              arguments: JSON.stringify(tc.args ?? {})
+            }
+          }))
+        };
+      }
+      return { role: m.role, content: m.content };
+    });
     const body = {
       model: config2.model,
-      messages: params.messages.filter((m) => m.role !== "tool").map((m) => ({ role: m.role, content: m.content })),
+      messages,
       stream: true,
       temperature: 0.7,
       // Task G.4.2 — request the provider to send real token usage in
@@ -2422,6 +2338,17 @@ function openaiCompatibleProvider(config2) {
       // the harness will fall back to the ~4-char/token approximation.
       stream_options: { include_usage: true }
     };
+    if (params.tools && params.tools.length > 0) {
+      body.tools = params.tools.map((t) => ({
+        type: "function",
+        function: {
+          name: t.name,
+          description: t.description,
+          parameters: t.parameters
+        }
+      }));
+      body.tool_choice = "auto";
+    }
     let response;
     try {
       response = await fetch(`${config2.baseUrl}/chat/completions`, {
@@ -2504,6 +2431,9 @@ function openaiCompatibleProvider(config2) {
                 }
               }
             }
+            if (choice?.finish_reason) {
+              yield { kind: "finish", reason: choice.finish_reason };
+            }
           } catch {
           }
         }
@@ -3005,11 +2935,11 @@ var TOOL_DEFINITIONS = [
     execute: (args, ctx) => {
       if (!ctx.addDocument) return "Knowledge vault tool not available.";
       const title = args["title"] || "New Document";
-      const path17 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+      const path18 = args["path"] || `notes/${title.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
       const content = args["content"] || "";
       const tags = args["tags"] || [];
       ctx.addDocument({
-        path: path17,
+        path: path18,
         title,
         content,
         format: "markdown",
@@ -3018,7 +2948,7 @@ var TOOL_DEFINITIONS = [
         workspaceId: ctx.workspaceId
       });
       ctx.addActivity("vault", "created document", title);
-      return `Document "${title}" created at "${path17}".`;
+      return `Document "${title}" created at "${path18}".`;
     }
   }
 ];
@@ -5285,10 +5215,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path17) {
-  if (!path17)
+function getElementAtPath(obj, path18) {
+  if (!path18)
     return obj;
-  return path17.reduce((acc, key) => acc?.[key], obj);
+  return path18.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -5697,11 +5627,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path17, issues) {
+function prefixIssues(path18, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path17);
+    iss.path.unshift(path18);
     return iss;
   });
 }
@@ -5848,16 +5778,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path17 = []) => {
+  const processError = (error52, path18 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path17, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path18, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
       } else {
-        const fullpath = [...path17, ...issue2.path];
+        const fullpath = [...path18, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -5884,17 +5814,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path17 = []) => {
+  const processError = (error52, path18 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path17, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path18, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path18, ...issue2.path]);
       } else {
-        const fullpath = [...path17, ...issue2.path];
+        const fullpath = [...path18, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -5926,8 +5856,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path17 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path17) {
+  const path18 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path18) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18619,13 +18549,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path17 = ref.slice(1).split("/").filter(Boolean);
-  if (path17.length === 0) {
+  const path18 = ref.slice(1).split("/").filter(Boolean);
+  if (path18.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path17[0] === defsKey) {
-    const key = path17[1];
+  if (path18[0] === defsKey) {
+    const key = path18[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19238,8 +19168,83 @@ var grepContentTool = {
   }
 };
 
-// src/cli/safety/sandboxPath.ts
+// src/main/core/tools/builtin/listFiles.ts
+import { promises as fs11 } from "node:fs";
 import path10 from "node:path";
+var ListFilesArgsSchema = external_exports.object({
+  /** Directory to list (relative to cwd or absolute). Defaults to cwd. */
+  path: external_exports.string().optional(),
+  /** Max traversal depth. 1 = immediate children only (default). */
+  maxDepth: external_exports.number().int().positive().max(10).default(1),
+  /** Glob-style patterns to exclude (matched against each entry name). */
+  exclude: external_exports.array(external_exports.string()).default([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".next",
+    "__pycache__",
+    ".cache"
+  ])
+});
+function matchesAny(name, patterns) {
+  return patterns.some((p3) => {
+    if (p3.includes("*")) {
+      const regex = new RegExp("^" + p3.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$");
+      return regex.test(name);
+    }
+    return name === p3;
+  });
+}
+async function walk(dir, baseRel, depth, maxDepth, exclude, entries, signal) {
+  if (depth > maxDepth) return;
+  let dirents;
+  try {
+    dirents = await fs11.readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  if (signal?.aborted) return;
+  for (const dirent of dirents) {
+    if (matchesAny(dirent.name, exclude)) continue;
+    const rel = baseRel ? `${baseRel}/${dirent.name}` : dirent.name;
+    const isDir = dirent.isDirectory();
+    entries.push({
+      name: rel,
+      type: isDir ? "directory" : dirent.isFile() ? "file" : "other"
+    });
+    if (isDir && depth < maxDepth) {
+      await walk(path10.join(dir, dirent.name), rel, depth + 1, maxDepth, exclude, entries, signal);
+    }
+  }
+}
+var listFilesTool = {
+  name: "list_files",
+  description: "List files and directories in the given path (defaults to the working directory). Returns names with types (file/directory). Use this to discover the project structure before reading specific files. Supports a maxDepth for recursive listing and excludes common dependency/build directories by default.",
+  permissions: ["read"],
+  timeoutMs: 15e3,
+  inputSchema: ListFilesArgsSchema,
+  execute: async (args, ctx) => {
+    try {
+      const target = args.path ? path10.isAbsolute(args.path) ? args.path : path10.join(ctx.cwd, args.path) : ctx.cwd;
+      const entries = [];
+      await walk(target, "", 1, args.maxDepth, args.exclude, entries, ctx.signal);
+      entries.sort((a, b) => {
+        if (a.type === "directory" && b.type !== "directory") return -1;
+        if (a.type !== "directory" && b.type === "directory") return 1;
+        return a.name.localeCompare(b.name);
+      });
+      const MAX_ENTRIES = 500;
+      const truncated = entries.length > MAX_ENTRIES;
+      return typedOk({ dir: target, entries: truncated ? entries.slice(0, MAX_ENTRIES) : entries, truncated });
+    } catch (err) {
+      return typedErr(err instanceof Error ? err.message : String(err));
+    }
+  }
+};
+
+// src/cli/safety/sandboxPath.ts
+import path11 from "node:path";
 var SandboxViolationError = class extends Error {
   constructor(message, attemptedPath, resolvedPath) {
     super(message);
@@ -19252,9 +19257,9 @@ function resolveSandboxedPath(userPath, options = {}) {
   if (typeof userPath !== "string" || userPath.length === 0) {
     throw new SandboxViolationError("Empty path", userPath, "");
   }
-  const root = path10.resolve(options.root ?? process.cwd());
-  const resolved = path10.isAbsolute(userPath) ? path10.resolve(userPath) : path10.resolve(root, userPath);
-  const rootWithSep = root.endsWith(path10.sep) ? root : root + path10.sep;
+  const root = path11.resolve(options.root ?? process.cwd());
+  const resolved = path11.isAbsolute(userPath) ? path11.resolve(userPath) : path11.resolve(root, userPath);
+  const rootWithSep = root.endsWith(path11.sep) ? root : root + path11.sep;
   if (resolved !== root && !resolved.startsWith(rootWithSep)) {
     throw new SandboxViolationError(
       `Path escapes sandbox root: ${userPath} \u2192 ${resolved} (root: ${root})`,
@@ -19317,8 +19322,8 @@ function assertShellAllowed(command) {
 }
 
 // src/cli/safety/auditLogger.ts
-import { promises as fs11 } from "node:fs";
-import path11 from "node:path";
+import { promises as fs12 } from "node:fs";
+import path12 from "node:path";
 import os7 from "node:os";
 var AuditLogger = class {
   logPath;
@@ -19337,8 +19342,8 @@ var AuditLogger = class {
   async append(entry) {
     const line = JSON.stringify(entry) + "\n";
     this.writeQueue = this.writeQueue.then(async () => {
-      await fs11.mkdir(path11.dirname(this.logPath), { recursive: true });
-      await fs11.appendFile(this.logPath, line, "utf-8");
+      await fs12.mkdir(path12.dirname(this.logPath), { recursive: true });
+      await fs12.appendFile(this.logPath, line, "utf-8");
     });
     return this.writeQueue;
   }
@@ -19381,7 +19386,7 @@ var AuditLogger = class {
 function defaultAuditPath() {
   const override = process.env.ANATHEMA_AUDIT_LOG;
   if (override && override.trim().length > 0) return override;
-  return path11.join(os7.tmpdir(), "zelari-code", "audit.jsonl");
+  return path12.join(os7.tmpdir(), "zelari-code", "audit.jsonl");
 }
 function redactArgs(args) {
   const redacted = {};
@@ -19413,6 +19418,7 @@ function createBuiltinToolRegistry(options = {}) {
   const safeWriteFile = wrapWithSandbox(writeFileTool, ["path"], root, audit, sessionId);
   const safeEditFile = wrapWithSandbox(editFileTool, ["path"], root, audit, sessionId);
   const safeGrepContent = wrapWithSandbox(grepContentTool, ["path"], root, audit, sessionId);
+  const safeListFiles = wrapWithSandbox(listFilesTool, ["path"], root, audit, sessionId);
   const safeBash = wrapWithShellSafety(bashTool, audit, sessionId);
   const registry3 = new ToolRegistry();
   registry3.register(safeReadFile);
@@ -19420,12 +19426,14 @@ function createBuiltinToolRegistry(options = {}) {
   registry3.register(safeEditFile);
   registry3.register(safeBash);
   registry3.register(safeGrepContent);
+  registry3.register(safeListFiles);
   const tools = [
     safeReadFile,
     safeWriteFile,
     safeEditFile,
     safeBash,
-    safeGrepContent
+    safeGrepContent,
+    safeListFiles
   ].map((t) => ({
     name: t.name,
     description: t.description,
@@ -19542,7 +19550,7 @@ function redactForAudit(args) {
 // src/cli/gitOps.ts
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import path12 from "node:path";
+import path13 from "node:path";
 var execFileAsync = promisify(execFile);
 async function git(cwd, args) {
   try {
@@ -19588,7 +19596,7 @@ async function undoWorkingChanges(opts = {}) {
   };
 }
 function defaultProjectRoot() {
-  return path12.resolve(__dirname, "..", "..", "..");
+  return path13.resolve(__dirname, "..", "..", "..");
 }
 
 // src/cli/compaction.ts
@@ -19629,16 +19637,16 @@ function formatCompactionSummary(result) {
 }
 
 // src/cli/metrics.ts
-import { promises as fs12, existsSync as existsSync7, statSync as statSync3, renameSync, appendFileSync, mkdirSync as mkdirSync7 } from "node:fs";
-import path13 from "node:path";
+import { promises as fs13, existsSync as existsSync7, statSync as statSync3, renameSync, appendFileSync, mkdirSync as mkdirSync7 } from "node:fs";
+import path14 from "node:path";
 import os8 from "node:os";
 var METRICS_ROTATE_BYTES = 10 * 1024 * 1024;
 var MetricsLogger = class {
   file;
   writeQueue = Promise.resolve();
   constructor(file2) {
-    this.file = file2 ?? process.env.ANATHEMA_METRICS_FILE ?? path13.join(os8.homedir(), ".tmp", "zelari-code", "metrics.jsonl");
-    mkdirSync7(path13.dirname(this.file), { recursive: true });
+    this.file = file2 ?? process.env.ANATHEMA_METRICS_FILE ?? path14.join(os8.homedir(), ".tmp", "zelari-code", "metrics.jsonl");
+    mkdirSync7(path14.dirname(this.file), { recursive: true });
   }
   /** Fire-and-forget record append. */
   record(rec) {
@@ -19689,8 +19697,8 @@ function getMetricsLogger() {
 }
 
 // src/cli/skillHistory.ts
-import { promises as fs13, existsSync as existsSync8, statSync as statSync4, renameSync as renameSync2, appendFileSync as appendFileSync2, mkdirSync as mkdirSync8 } from "node:fs";
-import path14 from "node:path";
+import { promises as fs14, existsSync as existsSync8, statSync as statSync4, renameSync as renameSync2, appendFileSync as appendFileSync2, mkdirSync as mkdirSync8 } from "node:fs";
+import path15 from "node:path";
 import os9 from "node:os";
 import { randomUUID as randomUUID2 } from "node:crypto";
 var SKILL_HISTORY_ROTATE_BYTES = 10 * 1024 * 1024;
@@ -19699,8 +19707,8 @@ var SkillHistoryLogger = class {
   writeQueue = Promise.resolve();
   inflight = /* @__PURE__ */ new Map();
   constructor(file2) {
-    this.file = file2 ?? process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path14.join(os9.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
-    mkdirSync8(path14.dirname(this.file), { recursive: true });
+    this.file = file2 ?? process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path15.join(os9.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+    mkdirSync8(path15.dirname(this.file), { recursive: true });
   }
   /**
    * Mark the start of a skill invocation. Returns a unique invocationId
@@ -19778,7 +19786,7 @@ var SkillHistoryLogger = class {
 async function readSkillHistory(file2) {
   let raw = "";
   try {
-    raw = await fs13.readFile(file2, "utf-8");
+    raw = await fs14.readFile(file2, "utf-8");
   } catch {
     return [];
   }
@@ -19814,7 +19822,7 @@ function getSkillStats(records, skillId, sinceTs) {
 }
 
 // src/cli/app.tsx
-import path16 from "node:path";
+import path17 from "node:path";
 import os10 from "node:os";
 var MODEL = process.env.OPENAI_MODEL ?? "grok-4";
 var PROVIDER = "openai-compatible";
@@ -20052,13 +20060,38 @@ function App() {
       primary: baseProviderStream,
       fallback: failoverResolution.fallback
     });
+    const cwd = process.cwd();
+    const toolList = toolRegistry.toOpenAITools().map((t) => `- ${t.name}: ${t.description}`).join("\n");
+    const systemPrompt = [
+      "You are Zelari Code, an interactive AI coding agent operating directly in the user's terminal.",
+      "",
+      "You ARE connected to this machine and have real tools to read, modify, and explore the codebase.",
+      "Never claim you lack filesystem or shell access \u2014 you have it. Use your tools instead of asking the user to paste file contents.",
+      "",
+      `# Working Directory`,
+      `You are running in: ${cwd}`,
+      "All relative file paths are resolved against this directory. Always work with real files here.",
+      "",
+      "# Available Tools",
+      "You can call these tools. Use them to take action and gather information autonomously:",
+      toolList,
+      "",
+      "# Guidelines",
+      "- To understand a project, list files (bash: ls) and read key files (read_file), don't ask the user to paste them.",
+      "- Be proactive: explore, read, and act. Prefer doing over asking.",
+      "- When you finish a task, briefly summarize what you did."
+    ].join("\n");
     const harness = new AgentHarness({
       model: envConfig.model,
       provider: PROVIDER,
-      messages: [{ role: "user", content: userText }],
+      messages: [
+        { role: "system", content: systemPrompt },
+        { role: "user", content: userText }
+      ],
       tools: toolRegistry.toOpenAITools(),
       toolRegistry,
-      providerStream
+      providerStream,
+      cwd
     });
     harnessRef.current = harness;
     setQueueCount(harness.queueLength);
@@ -20583,9 +20616,9 @@ ${lines.join("\n")}`;
     if (result.kind === "promote_member" && result.promoteMemberId) {
       try {
         const { skill, markdown } = promoteMember(result.promoteMemberId);
-        const skillDir = process.env.ANATHEMA_SKILL_DIR ?? path16.join(os10.homedir(), ".tmp", "zelari-code", "skills");
+        const skillDir = process.env.ANATHEMA_SKILL_DIR ?? path17.join(os10.homedir(), ".tmp", "zelari-code", "skills");
         await fs.promises.mkdir(skillDir, { recursive: true });
-        const filePath = path16.join(skillDir, `${skill.id}.md`);
+        const filePath = path17.join(skillDir, `${skill.id}.md`);
         await fs.promises.writeFile(filePath, markdown, "utf8");
         setMessages((prev) => [
           ...prev,
@@ -21219,14 +21252,27 @@ ${lines.join("\n")}`,
         {
           id: crypto.randomUUID(),
           role: "system",
-          content: "[login oauth] opening browser for SuperGrok authentication (PKCE)...",
+          content: "[login oauth] requesting device code from xAI...",
           ts: Date.now()
         }
       ]);
       setBusy(true);
       try {
         const resultOAuth = await runGrokOAuthFlow({
-          callbackTimeoutMs: 12e4
+          // Show the user_code + verification_uri as soon as xAI returns them.
+          onUserCode: (info) => {
+            setMessages((prev) => [
+              ...prev,
+              {
+                id: crypto.randomUUID(),
+                role: "system",
+                content: `[login oauth] Open ${info.verificationUri} in your browser and enter the code:
+  ${info.userCode}
+(Opening your browser automatically...)`,
+                ts: Date.now()
+              }
+            ]);
+          }
         });
         setOAuthToken("grok", {
           apiKey: resultOAuth.accessToken,
@@ -21302,7 +21348,7 @@ ${lines.join("\n")}`,
       return;
     }
     if (result.kind === "skill_stats") {
-      const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path16.join(os10.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+      const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path17.join(os10.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
       try {
         const records = await readSkillHistory(historyFile);
         const stats = getSkillStats(records, result.skillStatsSkillId);
@@ -21331,7 +21377,7 @@ ${lines.join("\n")}`,
         setInput("");
         return;
       }
-      const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path16.join(os10.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
+      const historyFile = process.env.ANATHEMA_SKILL_HISTORY_FILE ?? path17.join(os10.homedir(), ".tmp", "zelari-code", "skill-history.jsonl");
       try {
         const formatted = await compareSkillsFromFile(ids[0], ids[1], historyFile);
         setMessages((prev) => [