zames_pro 2.80.5 → 2.81.0

package/dist/net-capture.js

@@ -348,19 +348,72 @@ export function extractTokenUsage(body) {
     return found;
 }
 // Saves the DeepSeek network response body to disk for post-mortem analysis.
-// The files live in ~/.zames/net-log — from them the real answer format is visible.
-// DEBUG ONLY: disabled unless ZAMES_NET_DEBUG=1. It writes a file per network
-// response (thousands of files / tens of MB) and is not needed for the agent
-// to work — the answer is taken from extractAnswer() in memory.
+// DEBUG ONLY: disabled unless ZAMES_NET_DEBUG=1.
+//
+// The dumps live in ~/.zames/net-log and one file PER RESPONSE is written, so
+// an unattended `npm run dev` (which sets ZAMES_NET_DEBUG=1) used to grow the
+// directory without bound: 77k files / 800 MB after a few days. On WSL that
+// directory sits inside ext4.vhdx, and the space of thousands of tiny deleted
+// files is never returned to Windows — the host disk fills up. So the log is
+// ROTATED here: `NET_LOG_KEEP` newest dumps are kept and a rotation runs at
+// most once every `NET_LOG_ROTATE_MS` (listing the dir on every response would
+// itself cost time on a huge directory).
+const NET_LOG_KEEP = 200;
+const NET_LOG_ROTATE_MS = 5 * 60_000;
+const NET_LOG_MAX_BYTES = 32 * 1024 * 1024;
+let netLogDir = null;
+let netLogLastRotate = 0;
+function netLogDirectory() {
+    if (netLogDir === null) {
+        netLogDir = path.join(os.homedir(), '.zames', 'net-log');
+    }
+    return netLogDir;
+}
+/** A stamp prefix (`YYYY-MM-DDTHH-MM-SS-mmmZ_`) sorts chronologically. */
+function netLogStamp() {
+    return new Date().toISOString().replace(/[:.]/g, '-');
+}
 export async function dumpNetBody(url, body) {
     if (!process.env.ZAMES_NET_DEBUG)
         return;
     try {
-        const dir = path.join(os.homedir(), '.zames', 'net-log');
+        const dir = netLogDirectory();
         await fs.mkdir(dir, { recursive: true });
-        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
         const safe = url.replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 80);
-        await fs.writeFile(path.join(dir, stamp + '_' + safe + '.txt'), body, 'utf-8');
+        await fs.writeFile(path.join(dir, netLogStamp() + '_' + safe + '.txt'), body.slice(0, NET_LOG_MAX_BYTES), 'utf-8');
+        await rotateNetLogThrottled(dir);
     }
     catch { }
 }
+/**
+ * Keeps only the newest `NET_LOG_KEEP` dumps. Exported for the test: the
+ * rotation is the only thing standing between `ZAMES_NET_DEBUG=1` and an
+ * unbounded directory, so it is checked directly.
+ */
+export async function rotateNetLog(dir, keep = NET_LOG_KEEP, now = Date.now()) {
+    // The stamp prefix sorts the names chronologically, so a plain sort is
+    // enough — no stat() per file (a directory with 77k entries would make
+    // 77k syscalls on every response).
+    const names = (await fs.readdir(dir).catch(() => [])).filter((n) => n.endsWith('.txt'));
+    if (names.length <= keep)
+        return 0;
+    names.sort();
+    const stale = names.slice(0, names.length - keep);
+    let removed = 0;
+    for (const n of stale) {
+        await fs
+            .rm(path.join(dir, n), { force: true })
+            .then(() => removed++)
+            .catch(() => { });
+    }
+    netLogLastRotate = now;
+    return removed;
+}
+/** Throttled rotation used by dumpNetBody (at most once per interval). */
+async function rotateNetLogThrottled(dir) {
+    const now = Date.now();
+    if (now - netLogLastRotate < NET_LOG_ROTATE_MS)
+        return;
+    netLogLastRotate = now;
+    await rotateNetLog(dir, NET_LOG_KEEP, now);
+}

package/dist/provider-handoff.js

@@ -11,9 +11,20 @@ import fs from 'fs';
 import path from 'path';
 import os from 'os';
 import { writeJsonAtomic } from './fsutil.js';
+import { providerLabel } from './providers.js';
 const ZAMES_HOME = path.join(os.homedir(), '.zames');
 const HANDOFF_FILE = path.join(ZAMES_HOME, 'provider-handoff.json');
 const NL = String.fromCharCode(10);
+/**
+ * The DISPLAY label of the provider a handoff came from. Prefers the explicit
+ * `from` field; a legacy file (written when exactly two backends existed) has
+ * none, and there "the other one" is the only correct answer. PURE.
+ */
+export function handoffFromLabel(h) {
+    if (h.from)
+        return providerLabel(h.from);
+    return h.provider === 'qwen' ? 'DeepSeek' : 'Qwen';
+}
 /**
  * Wrap a cross-provider summary into the first message of the new provider's
  * chat. PURE (unit-tested): the wording must make clear this is carried-over

package/dist/providers.js

@@ -8,20 +8,55 @@
 // /doctor row, the {provider} label in operator messages, /chat URL) reads
 // from HERE, so nothing else has to be touched.
 //
+// CAPABILITY FLAGS: the code used to ask `provider === 'qwen'` in a dozen
+// places, which made "there are exactly two backends" a silent assumption and
+// broke the moment a third one arrived. The flags below are that knowledge,
+// stated once per provider, so every call site asks a CAPABILITY instead.
+//
 // This module is PURE (no imports, no side effects) so it can be imported from
 // anywhere without pulling in Playwright.
+import path from 'path';
+import os from 'os';
+/** `~/.zames/<dir>` — the per-provider profile location. */
+function zamesProfile(dir) {
+    return path.join(os.homedir(), '.zames', dir);
+}
 export const PROVIDERS = {
     deepseek: {
         id: 'deepseek',
         label: 'DeepSeek',
         chatUrlPrefix: 'https://chat.deepseek.com/a/chat/s',
+        chatUrl: 'https://chat.deepseek.com/',
+        chatIdPattern: '/a/chat/s/([A-Za-z0-9_-]+)',
         isDefault: true,
+        hasModelPicker: false,
+        guestAllowed: false,
+        profileDir: zamesProfile('profile'),
+        needsVisibleBrowser: false,
     },
     qwen: {
         id: 'qwen',
         label: 'Qwen',
         chatUrlPrefix: 'https://chat.qwen.ai/c',
+        chatUrl: 'https://chat.qwen.ai/',
+        chatIdPattern: '/c/([A-Za-z0-9_-]+)',
+        isDefault: false,
+        hasModelPicker: true,
+        guestAllowed: true,
+        profileDir: zamesProfile('qwen-profile'),
+        needsVisibleBrowser: false,
+    },
+    glm: {
+        id: 'glm',
+        label: 'GLM',
+        chatUrlPrefix: 'https://chat.z.ai/c',
+        chatUrl: 'https://chat.z.ai/',
+        chatIdPattern: '/c/([A-Za-z0-9_-]+)',
         isDefault: false,
+        hasModelPicker: true,
+        guestAllowed: true,
+        profileDir: zamesProfile('glm-profile'),
+        needsVisibleBrowser: true,
     },
 };
 /** All provider ids, in a stable order (default first). */
@@ -48,3 +83,33 @@ export function providerLabel(id) {
 export function providerChatUrlPrefix(id) {
     return isProviderId(id) ? PROVIDERS[id].chatUrlPrefix : '';
 }
+/** The provider's config section name (`qwen`, `glm`, …) or null for DeepSeek. */
+export function providerConfigSection(id) {
+    // DeepSeek's shared settings live in `browser`; the other backends own a
+    // per-provider section (qwen.*, glm.*).
+    return id === 'deepseek' ? null : id;
+}
+/** True when the provider exposes a model picker (`/model`). */
+export function providerHasModelPicker(id) {
+    return isProviderId(id) ? PROVIDERS[id].hasModelPicker : false;
+}
+/** True when an unsigned (guest) visitor is usable on the site. */
+export function providerGuestAllowed(id) {
+    return isProviderId(id) ? PROVIDERS[id].guestAllowed : false;
+}
+/** The persistent profile directory of a provider. */
+/** True when the provider needs a VISIBLE browser (a headless captcha). */
+export function providerNeedsVisibleBrowser(id) {
+    return isProviderId(id) ? PROVIDERS[id].needsVisibleBrowser : false;
+}
+export function providerProfileDir(id) {
+    return isProviderId(id) ? PROVIDERS[id].profileDir : '';
+}
+/** The chat home URL of a provider. */
+export function providerChatUrl(id) {
+    return isProviderId(id) ? PROVIDERS[id].chatUrl : '';
+}
+/** A provider's chat-id matcher (compiled from the registry pattern). */
+export function providerChatIdRe(id) {
+    return new RegExp(PROVIDERS[id].chatIdPattern);
+}

package/dist/qwen-browser.js

@@ -21,10 +21,11 @@ import os from 'os';
 import { chromium } from 'playwright';
 import { translate, DEFAULT_LOCALE } from './i18n.js';
 import { rewriteFailedAttachments } from './commands.js';
+import { interactiveBrowserLogin, loginIsInteractive, canShowWindow, } from './browser-login.js';
 import { awaitUploadPreview, readAttachBuffers } from './attach-flow.js';
 import { theme } from './theme.js';
 import { scrapeQwenChatList, scrapeQwenChatMessages, parseQwenChatList, parseQwenHistory, } from './qwen-chats.js';
-import { cleanAnswer, headlessEngineKey, readCachedHeadlessUA, writeCachedHeadlessUA, sanitizeHeadlessUA, cleanSingletonFiles, profileLooksLocked, nukeProfile, AUTH_MARKER_FILE, } from './browser-pure.js';
+import { cleanAnswer, headlessEngineKey, readCachedHeadlessUA, writeCachedHeadlessUA, sanitizeHeadlessUA, cleanSingletonFiles, profileLooksLocked, nukeProfile, writeAuthMarker, } from './browser-pure.js';
 import { chatSignalInDom, dumpDomCountsInDom, isElementEnabledInDom, readInputTrimmedTextInDom, readLastAnswerInDom, readPageToastsInDom, readUserAgentInDom, setBusyTitleInDom, clickStopInDom, stopButtonVisibleInDom, } from './browser-dom.js';
 import { probeUiHealth, } from './ui-health.js';
 import { CHAT_URL, CHAT_ID_RE, chatUrl, INPUT_SELECTORS, SEND_SELECTORS, STOP_SELECTORS, STOP_NAME_RE, NEW_CHAT_SELECTOR, MODEL_TRIGGER_SELECTOR, MODELS_URL, CHAT_LIST_URL, chatHistoryUrl, AGE_GATE_MODAL, AGE_GATE_CONTINUE, AGE_GATE_YEAR_SELECT, AGE_GATE_YEAR_OPTION, COOKIE_ACCEPT_RE, ATTACH_SELECTORS, ATTACH_MENU_TRIGGER, ATTACH_MENU_ITEM_RE, THINKING_SELECTOR, THINKING_MODE_RE, FAST_MODE_RE, WEB_SEARCH_MENU_RE, ANSWER_SELECTORS, THINK_CLASS_RE, MESSAGE_CONTAINER_SELECTORS, ASSISTANT_CLASS_RE, CHAT_SIGNAL_NODES_SELECTOR, MARKDOWN_SELECTOR, TOGGLE_SELECTORS, } from './qwen-ui.js';
@@ -122,7 +123,10 @@ export class QwenBrowser {
     onSendState;
     onNotice;
     userAgent;
-    constructor({ headless = false, debug = false, channel = null, answerTimeoutMs = 180000, askRetries = 3, stabilityChecks = 2, stabilityDelayMs = 400, minSendIntervalMs = 15000, rateLimitWaitMs = 300000, maxRateLimitRetries = 6, maxServerBusyRetries = 5, serverBusyWaitMs = 3000, maxIncompleteRetries = 4, incompleteWaitMs = 2000, startWaitMs = 30000, sendButtonWaitMs = 8000, model = '', deepThinking = false, webSearch = true, auth, locale, onAuthSave, onLoginPrompt, userAgent, } = {}) {
+    loginTimeoutMs;
+    _windowClosed;
+    _carryCookies;
+    constructor({ headless = false, debug = false, channel = null, answerTimeoutMs = 180000, askRetries = 3, stabilityChecks = 2, stabilityDelayMs = 400, minSendIntervalMs = 15000, rateLimitWaitMs = 300000, maxRateLimitRetries = 6, maxServerBusyRetries = 5, serverBusyWaitMs = 3000, maxIncompleteRetries = 4, incompleteWaitMs = 2000, startWaitMs = 30000, sendButtonWaitMs = 8000, model = '', deepThinking = false, webSearch = true, auth, locale, onAuthSave, onLoginPrompt, loginTimeoutMs = 600000, userAgent, } = {}) {
         this.headless = headless;
         this.debug = debug;
         this.channel = channel;
@@ -178,6 +182,9 @@ export class QwenBrowser {
         this.onSendState = null;
         this.onNotice = null;
         this.userAgent = userAgent || '';
+        this.loginTimeoutMs = loginTimeoutMs;
+        this._windowClosed = false;
+        this._carryCookies = null;
     }
     _t(key, params) {
         return translate(this.locale)(key, { provider: 'Qwen', ...params });
@@ -221,7 +228,7 @@ export class QwenBrowser {
             await cleanSingletonFiles(QWEN_USER_DATA_DIR);
         }
         if (this.headless && !this.userAgent) {
-            const cached = await readCachedHeadlessUA(headlessEngineKey() + ':qwen');
+            const cached = await readCachedHeadlessUA(headlessEngineKey());
             if (cached)
                 this.userAgent = cached;
         }
@@ -242,7 +249,7 @@ export class QwenBrowser {
             if (fixed === ua)
                 return;
             this.userAgent = fixed;
-            void writeCachedHeadlessUA(headlessEngineKey() + ':qwen', fixed);
+            void writeCachedHeadlessUA(headlessEngineKey(), fixed);
             if (this.debug)
                 console.error('qwen profile: headless UA -> relaunching plain Chrome UA');
             await this.context.close().catch(() => { });
@@ -341,6 +348,30 @@ export class QwenBrowser {
         catch { }
     }
     async close() {
+        // A session cookie (expires = -1) is dropped when the context closes, so a
+        // sign-in would not survive the process. Re-add it as a PERSISTENT cookie
+        // before closing: the token then lives in the profile and the next launch
+        // is signed in without a window.
+        try {
+            if (this.context) {
+                const cookies = await this.context.cookies();
+                const session = cookies.filter((c) => c.expires === -1 || c.expires < 0);
+                if (session.length) {
+                    const keepUntil = Math.floor((Date.now() + 15552000000) / 1000);
+                    await this.context.addCookies(session.map((c) => ({
+                        name: c.name,
+                        value: c.value,
+                        domain: c.domain,
+                        path: c.path,
+                        httpOnly: c.httpOnly,
+                        secure: c.secure,
+                        sameSite: c.sameSite,
+                        expires: keepUntil,
+                    })));
+                }
+            }
+        }
+        catch { }
         try {
             if (this.context)
                 await this.context.close();
@@ -481,41 +512,245 @@ export class QwenBrowser {
         }
         return false;
     }
-    async waitForLogin() {
-        if (await this.isLoggedIn()) {
-            if (this.debug)
-                console.error('qwen auth: session already active');
-            await this._persistSessionIfNeeded();
-            return;
+    /**
+     * A FAST login probe: Qwen's own `auths/refresh` API needs the app's header,
+     * so it cannot be replayed from a bare fetch. Instead the page reports
+     * whether a token is in storage and whether a sign-in control is visible. A
+     * guest ALSO sees the input, so the input alone must never mean "signed in".
+     */
+    async probeLogin() {
+        if (!this.page)
+            return 'unknown';
+        try {
+            const r = await this.page.evaluate(() => {
+                const hasToken = (() => {
+                    try {
+                        return !!localStorage.getItem('token');
+                    }
+                    catch {
+                        return false;
+                    }
+                })();
+                const body = document.body ? document.body.innerText : '';
+                const signInVisible = /\b(log ?in|sign ?in)\b/i.test(body);
+                return { hasToken, signInVisible };
+            });
+            if (r.hasToken)
+                return 'in';
+            if (r.signInVisible)
+                return 'out';
+            return 'unknown';
         }
-        // No stored session: Qwen still answers a GUEST for a limited number of
-        // turns, but the agent is multi-turn by nature, so a real login is
-        // strongly recommended. Try the saved credentials first, then ask the
-        // operator in a TTY.
-        if (this.auth.username) {
-            if (await this._autoLogin()) {
-                await this._persistSessionIfNeeded();
-                return;
-            }
+        catch {
+            return 'unknown';
+        }
+    }
+    /**
+     * A human signs in inside a VISIBLE window (a one-time code cannot be typed
+     * into a terminal), then zames returns to headless. The decision sequence is
+     * the shared interactiveBrowserLogin.
+     */
+    async _browserLogin() {
+        const interactive = loginIsInteractive({
+            isTTY: !!(process.stdin.isTTY && process.stdout.isTTY),
+            oneShot: false,
+            scheduled: false,
+            env: process.env,
+        });
+        await interactiveBrowserLogin({
+            provider: 'Qwen',
+            probeLogin: () => this.probeLogin(),
+            autoLogin: () => this._autoLogin(),
+            relaunch: (h) => this.relaunchSafe(h),
+            openLoginPage: () => this._openLoginPage(),
+            gotoChat: async () => {
+                await this.page
+                    .goto(CHAT_URL, { waitUntil: 'domcontentloaded', timeout: 30000 })
+                    .catch(() => { });
+            },
+            prefill: async () => {
+                try {
+                    if (!this.auth.username)
+                        return;
+                    const email = this.page
+                        .locator('input[name="email"], input[type="email"]')
+                        .first();
+                    if ((await email.count().catch(() => 0)) === 0)
+                        return;
+                    if (await email.isVisible().catch(() => false)) {
+                        await email
+                            .fill(this.auth.username, { timeout: 2000 })
+                            .catch(() => { });
+                    }
+                }
+                catch { }
+            },
+            captureCredentials: async () => {
+                try {
+                    await this.page.exposeFunction('__zamesQwenCreds', (u) => {
+                        const user = String(u || '').trim();
+                        if (!user)
+                            return;
+                        this.auth.username = user;
+                        try {
+                            this.onAuthSave?.(user, '');
+                        }
+                        catch { }
+                    });
+                    await this.page.evaluate(() => {
+                        const w = window;
+                        if (w.__zamesQwenHooked)
+                            return;
+                        w.__zamesQwenHooked = true;
+                        document.addEventListener('submit', (ev) => {
+                            try {
+                                const form = ev.target;
+                                if (!form)
+                                    return;
+                                const e = form.querySelector('input[type="email"], input[name="email"]');
+                                const fn = window.__zamesQwenCreds;
+                                if (fn && e)
+                                    fn(e.value || '');
+                            }
+                            catch { }
+                        }, true);
+                    });
+                }
+                catch { }
+            },
+            persistSession: () => this._persistSessionIfNeeded(),
+            notice: (key) => this._notice(this._t(key)),
+            isAborted: () => this._abort,
+            windowClosed: () => this._windowClosed,
+            sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+            now: () => Date.now(),
+            interactive,
+            stayHeaded: !this.headless,
+            guestAllowed: true,
+            canShowWindow: canShowWindow(process.env, process.platform),
+            tuiLogin: this.onLoginPrompt
+                ? async () => {
+                    return await this._promptAndLogin();
+                }
+                : undefined,
+            timeoutMs: this.loginTimeoutMs,
+        });
+    }
+    /** Relaunch in another headless mode (login flow), keeping session cookies. */
+    async relaunchSafe(headless) {
+        try {
+            const cookies = await this.context.cookies();
+            const session = cookies.filter((c) => c.expires === -1 || c.expires < 0);
+            if (session.length)
+                this._carryCookies = session;
         }
-        if (process.stdin.isTTY) {
-            await this._promptAndLogin();
+        catch { }
+        try {
+            if (this.context)
+                await this.context.close();
         }
-        else {
-            this._notice(this._t('qwen.guest_mode'));
+        catch { }
+        const deadline = Date.now() + 15000;
+        while (Date.now() < deadline) {
+            if (!(await profileLooksLocked(QWEN_USER_DATA_DIR)))
+                break;
+            await new Promise((r) => setTimeout(r, 200));
+        }
+        this.headless = headless;
+        const options = {
+            headless,
+            slowMo: 10,
+            args: ['--disable-blink-features=AutomationControlled'],
+        };
+        if (this.channel)
+            options.channel = this.channel;
+        if (this.userAgent)
+            options.userAgent = this.userAgent;
+        try {
+            this.context = await chromium.launchPersistentContext(QWEN_USER_DATA_DIR, options);
+        }
+        catch (e) {
+            throw new Error('qwen: the browser profile is busy (' + e.message + ')');
+        }
+        if (this._carryCookies && this._carryCookies.length) {
+            await this.context.addCookies(this._carryCookies).catch(() => { });
         }
-        await this._persistSessionIfNeeded();
+        this.page = this.context.pages()[0] || (await this.context.newPage());
+        this._windowClosed = false;
+        this.page.on('close', () => {
+            this._windowClosed = true;
+        });
+        this.context.on('close', () => {
+            this._windowClosed = true;
+        });
+        this._netHookInstalled = false;
+        this._netHookPage = null;
+        this._installNetHook();
+    }
+    async waitForLogin() {
+        // An existing session, then the saved credentials, then (Qwen allows a
+        // guest, so no error) the guest notice. The visible window and the return
+        // to headless are the SHARED interactiveBrowserLogin path.
+        const interactive = loginIsInteractive({
+            isTTY: !!(process.stdin.isTTY && process.stdout.isTTY),
+            oneShot: false,
+            scheduled: false,
+            env: process.env,
+        });
+        const outcome = await interactiveBrowserLogin({
+            provider: 'Qwen',
+            probeLogin: () => this.probeLogin(),
+            autoLogin: () => this._autoLogin(),
+            relaunch: (h) => this.relaunchSafe(h),
+            openLoginPage: () => this._openLoginPage(),
+            gotoChat: async () => {
+                await this.page
+                    .goto(CHAT_URL, { waitUntil: 'domcontentloaded', timeout: 30000 })
+                    .catch(() => { });
+            },
+            prefill: async () => {
+                try {
+                    if (!this.auth.username)
+                        return;
+                    const email = this.page
+                        .locator('input[name="email"], input[type="email"]')
+                        .first();
+                    if ((await email.count().catch(() => 0)) === 0)
+                        return;
+                    if (await email.isVisible().catch(() => false)) {
+                        await email.fill(this.auth.username).catch(() => { });
+                    }
+                }
+                catch { }
+            },
+            captureCredentials: async () => { },
+            persistSession: () => this._persistSessionIfNeeded(),
+            notice: (key) => this._notice(this._t(key)),
+            isAborted: () => this._abort,
+            windowClosed: () => this._windowClosed,
+            sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+            now: () => Date.now(),
+            interactive,
+            stayHeaded: !this.headless,
+            // A guest is usable, but a real session is strongly recommended; the
+            // notice tells the operator why.
+            guestAllowed: true,
+            canShowWindow: canShowWindow(process.env, process.platform),
+            tuiLogin: this.onLoginPrompt
+                ? async () => await this._promptAndLogin()
+                : undefined,
+            timeoutMs: this.loginTimeoutMs,
+        });
+        if (outcome === 'guest')
+            this._notice(this._t('qwen.guest_mode'));
+        await this._persistSessionIfNeeded().catch(() => { });
     }
     async _persistSessionIfNeeded() {
         if (!this.auth.saveSession)
             return;
         if (!(await this.isLoggedIn()))
             return;
-        try {
-            await fs.mkdir(path.dirname(AUTH_MARKER_FILE), { recursive: true });
-            await fs.writeFile(AUTH_MARKER_FILE, JSON.stringify({ provider: 'qwen', at: new Date().toISOString() }), 'utf-8');
-        }
-        catch { }
+        await writeAuthMarker('qwen');
     }
     // Best-effort PASSWORD login for the saved credentials. Qwen's default form
     // is the email CODE flow, so this first switches to the password form (the
@@ -548,8 +783,17 @@ export class QwenBrowser {
             await pwd.fill(this.auth.password);
             await this._clickSubmit();
             const ok = await this._waitLoggedIn(20000);
-            if (ok)
+            if (ok) {
                 this._notice(this._t('qwen.login_ok'));
+                // Remember the credentials that WORKED, so the next launch signs in
+                // silently without a window. The auto-login is the one path that used
+                // to skip this, which is why a successful auto sign-in left the
+                // config without the password and the NEXT cold start needed a window.
+                try {
+                    this.onAuthSave?.(this.auth.username, this.auth.password);
+                }
+                catch { }
+            }
             return ok;
         }
         catch (e) {

package/dist/send-runtime.js

@@ -0,0 +1,112 @@
+// Per-browser SEND RUNTIME: telemetry + the adaptive throttle, wired in ONE
+// place so each provider class only forwards its send events here.
+//
+// WHY a helper instead of per-class code: the three backends (DeepSeek, Qwen,
+// GLM) share the policy but differ in where a send starts and how an error is
+// classified. Keeping the state machine here means one implementation to test
+// and one place to look at when "the agent waits too long" is reported.
+//
+// The state lives ON the browser object (a SendRuntime instance), so it
+// survives across tasks and a provider switch within a session (a new browser
+// object is created, but the operator's decision about the interval does not
+// silently reset mid-session — it is re-derived from this session's events).
+import { DEFAULT_THROTTLE, initialThrottleState, applySendEvent, nextWaitMs, withBlockDuration, } from './send-throttle.js';
+import { appendSendEvent, } from './send-telemetry.js';
+/**
+ * The runtime a provider keeps: the learned interval, the last send and the
+ * bookkeeping needed to record the outcome of the NEXT send.
+ */
+export class SendRuntime {
+    cfg;
+    state;
+    opts;
+    now;
+    lastSentAt = 0;
+    pending = null;
+    constructor(opts) {
+        this.opts = opts;
+        this.now = opts.now || Date.now;
+        this.cfg = {
+            baseMs: opts.baseMs,
+            rateLimitWaitMs: opts.rateLimitWaitMs,
+            ...DEFAULT_THROTTLE,
+            windowMs: opts.windowMs ?? DEFAULT_THROTTLE.windowMs,
+            budget: opts.budget ?? DEFAULT_THROTTLE.budget,
+        };
+        this.state = initialThrottleState(this.cfg);
+    }
+    /** The interval currently in force (the adaptive one when enabled). */
+    intervalMs() {
+        return this.opts.adaptive ? this.state.intervalMs : this.opts.baseMs;
+    }
+    /** Milliseconds to wait before the next send. */
+    waitMs() {
+        if (!this.opts.adaptive) {
+            const gap = this.opts.baseMs - (this.now() - this.lastSentAt);
+            return this.lastSentAt && gap > 0 ? gap : 0;
+        }
+        return nextWaitMs(this.state, this.lastSentAt, this.now());
+    }
+    /**
+     * Mark a send as STARTED. `model`/`thinking`/`webSearch` are recorded with
+     * the outcome, so a later analysis can correlate a limit with a mode.
+     */
+    onSend(info = {}) {
+        const waited = this.lastSentAt ? this.now() - this.lastSentAt : 0;
+        this.lastSentAt = this.now();
+        this.pending = {
+            at: new Date(this.lastSentAt).toISOString(),
+            provider: this.opts.provider,
+            model: info.model,
+            thinking: info.thinking,
+            webSearch: info.webSearch,
+            intervalMs: this.intervalMs(),
+            waitedMs: waited,
+            outcome: 'ok',
+        };
+    }
+    /**
+     * Record the outcome of the send started by onSend(). `errorText` and
+     * `retryAfterMs` come from the server and never include the prompt.
+     */
+    onOutcome(outcome, extra = {}) {
+        if (!this.pending)
+            return;
+        let e = { ...this.pending, outcome };
+        if (extra.errorText)
+            e.errorText = String(extra.errorText).slice(0, 300);
+        if (typeof extra.retryAfterMs === 'number') {
+            e.retryAfterMs = extra.retryAfterMs;
+        }
+        if (this.opts.adaptive) {
+            this.state = applySendEvent(this.state, e, this.cfg, this.now());
+        }
+        if (outcome === 'rate_limit') {
+            e = withBlockDuration(e, this.state.blockedAt, this.now());
+        }
+        if (this.opts.telemetry) {
+            appendSendEvent(this.opts.logsDir, e);
+        }
+        this.pending = null;
+    }
+    /**
+     * The block lifted (the next send succeeded after a rate limit): the
+     * telemetry gets the measured duration.
+     */
+    onBlockLifted() {
+        if (!this.state.blockedAt)
+            return;
+        const liftedAt = this.now();
+        if (this.opts.telemetry) {
+            appendSendEvent(this.opts.logsDir, {
+                at: new Date(liftedAt).toISOString(),
+                provider: this.opts.provider,
+                intervalMs: this.intervalMs(),
+                waitedMs: 0,
+                outcome: 'ok',
+                blockMs: liftedAt - this.state.blockedAt,
+            });
+        }
+        this.state = { ...this.state, blocked: false, blockedAt: 0 };
+    }
+}