zames_pro 2.80.8 → 2.81.0

package/dist/browser.js

@@ -1,4 +1,5 @@
 import { chromium, } from 'playwright';
+import { interactiveBrowserLogin, loginIsInteractive, canShowWindow, } from './browser-login.js';
 import { extractAnswer, extractTokenUsage, dumpNetBody, isFinishedWithoutAnswer, isFinishedWithAnswer, } from './net-capture.js';
 import { rewriteFailedAttachments } from './commands.js';
 import { awaitUploadPreview, readAttachBuffers } from './attach-flow.js';
@@ -20,7 +21,7 @@ export { STOP_NAME_RE, CONTINUE_NAME_RE };
 // imported for the class below and RE-EXPORTED here, so the public API of this
 // module is unchanged (tests and other modules import these names from
 // './browser.js').
-import { askPassword, USER_DATA_DIR, parseHeadlessUACache, headlessEngineKey, readCachedHeadlessUA, writeCachedHeadlessUA, headlessUACacheReady, sanitizeHeadlessUA, AUTH_MARKER_FILE, isGenerationIncompleteText, isRateLimitText, isServerBusyText, normText, cleanAnswer, RateLimitError, ServerBusyError, GenerationIncompleteError, cleanSingletonFiles, profileLooksLocked, nukeProfile, } from './browser-pure.js';
+import { askPassword, USER_DATA_DIR, parseHeadlessUACache, headlessEngineKey, readCachedHeadlessUA, writeCachedHeadlessUA, headlessUACacheReady, sanitizeHeadlessUA, writeAuthMarker, isGenerationIncompleteText, isRateLimitText, isServerBusyText, normText, cleanAnswer, RateLimitError, ServerBusyError, GenerationIncompleteError, cleanSingletonFiles, profileLooksLocked, nukeProfile, } from './browser-pure.js';
 export { askPassword, parseHeadlessUACache, headlessUACacheReady, sanitizeHeadlessUA, isGenerationIncompleteText, isRateLimitText, isServerBusyText, normText, RateLimitError, ServerBusyError, GenerationIncompleteError, };
 export class DeepSeekBrowser {
     providerName = 'deepseek';
@@ -161,7 +162,13 @@ export class DeepSeekBrowser {
     // must be stripped (DeepSeek's CDN answers 403 to it); computed in the
     // constructor, overridable by an explicit UA in the options/config.
     userAgent;
-    constructor({ headless = false, debug = false, channel = 'chrome', answerTimeoutMs = 180000, askRetries = 3, stabilityChecks = 2, stabilityDelayMs = 400, minSendIntervalMs = 15000, thinkingExtraMs = 2000, rateLimitWaitMs = 300000, maxRateLimitRetries = 6, maxServerBusyRetries = 5, serverBusyWaitMs = 3000, maxIncompleteRetries = 4, incompleteWaitMs = 2000, autoContinue = true, continueMinGapMs = 1500, deepThinking = false, webSearch = true, auth, locale, onAuthSave, onLoginPrompt, onMfaPrompt, userAgent, } = {}) {
+    /** Login-window timeout (ms) from browser.loginTimeoutMs. */
+    loginTimeoutMs;
+    /** True once the operator closed the browser window (counts as "done"). */
+    _windowClosed;
+    /** Session cookies captured before a relaunch (no `expires` -> in-memory). */
+    _carryCookies;
+    constructor({ headless = false, debug = false, channel = 'chrome', answerTimeoutMs = 180000, askRetries = 3, stabilityChecks = 2, stabilityDelayMs = 400, minSendIntervalMs = 15000, thinkingExtraMs = 2000, rateLimitWaitMs = 300000, maxRateLimitRetries = 6, maxServerBusyRetries = 5, serverBusyWaitMs = 3000, maxIncompleteRetries = 4, incompleteWaitMs = 2000, autoContinue = true, continueMinGapMs = 1500, loginTimeoutMs = 600000, deepThinking = false, webSearch = true, auth, locale, onAuthSave, onLoginPrompt, onMfaPrompt, userAgent, } = {}) {
         this.headless = headless;
         this.debug = debug;
         this.channel = channel;
@@ -179,6 +186,9 @@ export class DeepSeekBrowser {
         this.incompleteWaitMs = incompleteWaitMs;
         this.autoContinue = autoContinue;
         this.continueMinGapMs = continueMinGapMs;
+        this.loginTimeoutMs = loginTimeoutMs;
+        this._windowClosed = false;
+        this._carryCookies = null;
         this.deepThinking = deepThinking;
         this.webSearch = webSearch;
         this.auth = {
@@ -508,6 +518,230 @@ export class DeepSeekBrowser {
         await this._launchOnce();
         await this._fixHeadlessUserAgent();
     }
+    /**
+     * PURE-ish gate: may the login open a visible window? False for --task, a
+     * scheduler job, a non-TTY or ZAMES_NONINTERACTIVE_LOGIN=1 (the smoke
+     * scripts set it so a cold login fails fast instead of hanging), and when no
+     * display is available at all.
+     */
+    canShowLoginWindow() {
+        const interactive = loginIsInteractive({
+            isTTY: !!(process.stdin.isTTY && process.stdout.isTTY),
+            oneShot: false,
+            scheduled: false,
+            env: process.env,
+        });
+        if (!interactive)
+            return false;
+        return canShowWindow(process.env, process.platform);
+    }
+    /**
+     * The human-in-the-window fallback: DeepSeek shows a captcha often enough
+     * that a terminal prompt cannot pass it, so the operator signs in inside a
+     * VISIBLE browser window and zames then returns to headless. The decision
+     * sequence is the shared interactiveBrowserLogin; this method only supplies
+     * the DeepSeek-specific callbacks.
+     */
+    async _browserLogin() {
+        const stayHeaded = !this.headless;
+        const interactive = loginIsInteractive({
+            isTTY: !!(process.stdin.isTTY && process.stdout.isTTY),
+            oneShot: false,
+            scheduled: false,
+            env: process.env,
+        });
+        await interactiveBrowserLogin({
+            provider: 'DeepSeek',
+            probeLogin: () => this.probeLogin(),
+            autoLogin: () => this._autoLogin(),
+            relaunch: (h) => this.relaunchSafe(h),
+            openLoginPage: () => this._openLoginPage(),
+            gotoChat: async () => {
+                await this.page
+                    .goto('https://chat.deepseek.com/', {
+                    waitUntil: 'domcontentloaded',
+                    timeout: 30000,
+                })
+                    .catch(() => { });
+            },
+            prefill: async () => {
+                try {
+                    if (!this.auth.username)
+                        return;
+                    const u = await this._findVisible(LOGIN_SELECTORS, 1500);
+                    if (u)
+                        await u.fill(this.auth.username).catch(() => { });
+                }
+                catch { }
+            },
+            captureCredentials: async () => {
+                try {
+                    await this.page.exposeFunction('__zamesDsCreds', (u, p) => {
+                        const user = String(u || '').trim();
+                        const pass = String(p || '');
+                        if (!user)
+                            return;
+                        this.auth.username = user;
+                        if (pass)
+                            this.auth.password = pass;
+                        try {
+                            this.onAuthSave?.(user, pass);
+                        }
+                        catch { }
+                    });
+                    await this.page.evaluate(() => {
+                        const w = window;
+                        if (w.__zamesDsHooked)
+                            return;
+                        w.__zamesDsHooked = true;
+                        document.addEventListener('submit', (ev) => {
+                            try {
+                                const form = ev.target;
+                                if (!form)
+                                    return;
+                                const u = form.querySelector('input');
+                                const p = form.querySelector('input[type="password"]');
+                                const fn = window.__zamesDsCreds;
+                                if (fn)
+                                    fn(u ? u.value || '' : '', p ? p.value || '' : '');
+                            }
+                            catch { }
+                        }, true);
+                    });
+                }
+                catch { }
+            },
+            persistSession: () => this._persistSessionIfNeeded(),
+            notice: (key) => console.log(theme.system(this._t(key))),
+            isAborted: () => this._abort,
+            windowClosed: () => this._windowClosed,
+            sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+            now: () => Date.now(),
+            interactive,
+            stayHeaded,
+            guestAllowed: false,
+            canShowWindow: true,
+            timeoutMs: this.loginTimeoutMs,
+        });
+    }
+    /**
+     * A FAST login probe (no long waits). The old isLoggedIn() waited 2 s for
+     * the input to appear, which is a false "logged out" on a slow network.
+     * The signal is a storage token plus a cheap API answer; the DOM is a
+     * fallback only.
+     */
+    async probeLogin() {
+        if (!this.page)
+            return 'unknown';
+        try {
+            const r = await this.page.evaluate(async () => {
+                const hasToken = (() => {
+                    try {
+                        return (!!localStorage.getItem('userToken') ||
+                            !!localStorage.getItem('token'));
+                    }
+                    catch {
+                        return false;
+                    }
+                })();
+                let api = false;
+                try {
+                    const res = await fetch('/api/v0/users/current', {
+                        credentials: 'include',
+                        headers: { accept: 'application/json' },
+                    });
+                    api = res.ok;
+                }
+                catch { }
+                const body = document.body ? document.body.innerText : '';
+                const signInVisible = /log ?in|sign ?in|войти/i.test(body);
+                return { hasToken, api, signInVisible };
+            });
+            if (r.hasToken && r.api)
+                return 'in';
+            if (r.hasToken)
+                return 'in';
+            if (r.signInVisible)
+                return 'out';
+            return 'unknown';
+        }
+        catch {
+            return 'unknown';
+        }
+    }
+    /**
+     * Relaunch the persistent context in another headless mode. A SEPARATE path
+     * from _launchOnce: it must not clean the Singleton files or nuke the
+     * profile, it waits for the previous context to release the lock and it
+     * re-applies session-only cookies (a cookie with no `expires` is dropped on
+     * close and the SPA would answer 401).
+     */
+    async relaunchSafe(headless) {
+        try {
+            const cookies = await this.context.cookies();
+            const session = cookies.filter((c) => c.expires === -1 || c.expires < 0);
+            if (session.length)
+                this._carryCookies = session;
+        }
+        catch { }
+        try {
+            if (this.context)
+                await this.context.close();
+        }
+        catch { }
+        const deadline = Date.now() + 15000;
+        while (Date.now() < deadline) {
+            if (!(await profileLooksLocked()))
+                break;
+            await new Promise((r) => setTimeout(r, 200));
+        }
+        this.headless = headless;
+        this.userAgent = this.userAgent || '';
+        const options = {
+            headless,
+            slowMo: 10,
+            args: ['--disable-blink-features=AutomationControlled'],
+        };
+        if (this.channel)
+            options.channel = this.channel;
+        if (this.userAgent)
+            options.userAgent = this.userAgent;
+        try {
+            this.context = await chromium.launchPersistentContext(USER_DATA_DIR, options);
+        }
+        catch (e) {
+            throw new Error('deepseek: the browser profile is busy (' + e.message + ')');
+        }
+        if (this._carryCookies && this._carryCookies.length) {
+            await this.context.addCookies(this._carryCookies).catch(() => { });
+        }
+        this.page = this.context.pages()[0] || (await this.context.newPage());
+        this._windowClosed = false;
+        this.page.on('close', () => {
+            this._windowClosed = true;
+        });
+        this.context.on('close', () => {
+            this._windowClosed = true;
+        });
+        this._netHookInstalled = false;
+        this._netHookPage = null;
+        this._installNetHook();
+    }
+    /** Open DeepSeek's sign-in page (it is the same origin). */
+    async _openLoginPage() {
+        try {
+            if (!/sign_in|login/i.test(this.page.url())) {
+                const btn = this.page
+                    .getByRole('button', { name: /log ?in|sign ?in|войти/i })
+                    .first();
+                if (await btn.count().catch(() => 0)) {
+                    await btn.click({ timeout: 3000 }).catch(() => { });
+                    await this.page.waitForTimeout(1500);
+                }
+            }
+        }
+        catch { }
+    }
     async waitForLogin() {
         // 1) Already signed in (session cookie in the persistent profile)?
         if (await this.isLoggedIn()) {
@@ -515,11 +749,8 @@ export class DeepSeekBrowser {
                 console.error('auth: session already active');
             return;
         }
-        // 2) Try to sign in automatically with the saved credentials. The
-        //    password lives in the config (~/.zames/config.json) and is only used
-        //    when the session is logged out — i.e. exactly the "re-login without
-        //    asking" case. If the login form is absent (e.g. DeepSeek uses a
-        //    captcha / another provider), this fails and we fall through.
+        // 2) The saved credentials. They are permanent, so a logged-out profile
+        //    signs in silently — this is the FIRST fallback.
         if (this.auth.username && this.auth.password) {
             console.log(theme.system(this._t('auth.auto_login')));
             const ok = await this._autoLogin().catch((e) => {
@@ -531,9 +762,17 @@ export class DeepSeekBrowser {
                 return;
             }
         }
-        // 3) Ask the operator for credentials in the terminal, try them, and
-        //    only then fall back to the manual hint. Interactive only: in a
-        //    pipe/redirect (or headless without credentials) we print a hint.
+        // 3) A HUMAN signs in inside a VISIBLE browser window — DeepSeek shows a
+        //    captcha that neither a terminal prompt nor a filled form can pass.
+        //    The shared module decides whether a window can be shown, waits for
+        //    the sign-in and returns to headless afterwards. A visible window is
+        //    kept when the operator asked for it (--headed / --dev / hotReload).
+        if (this.canShowLoginWindow()) {
+            await this._browserLogin();
+            return;
+        }
+        // 4) No window (no display / non-interactive): the in-terminal form is the
+        //    accepted fallback, then a manual hint.
         const asked = await this._promptAndLogin().catch((e) => {
             if (this.debug)
                 console.error('auth: prompt error:', e.message);
@@ -541,7 +780,6 @@ export class DeepSeekBrowser {
         });
         if (asked)
             return;
-        // 4) Last resort: manual sign-in in the browser window.
         console.log('\n' + theme.warn(this._t('auth.need_login')));
         if (this.headless) {
             console.log('   ' + this._t('auth.manual_hint_headless'));
@@ -928,11 +1166,7 @@ export class DeepSeekBrowser {
             return;
         if (!(await this.isLoggedIn().catch(() => false)))
             return;
-        try {
-            await fs.mkdir(path.join(os.homedir(), '.zames'), { recursive: true });
-            await fs.writeFile(AUTH_MARKER_FILE, JSON.stringify({ at: new Date().toISOString() }, null, 2), 'utf-8');
-        }
-        catch { }
+        await writeAuthMarker('deepseek');
     }
     async isLoggedIn() {
         // Single combined query with a short timeout: the old loop waited up to
@@ -2510,6 +2744,30 @@ export class DeepSeekBrowser {
         return this._lastTokenUsage;
     }
     async close() {
+        // A session cookie (expires = -1) is dropped when the context closes, so a
+        // sign-in would not survive the process. Re-add it as a PERSISTENT cookie
+        // before closing: the token then lives in the profile and the next launch
+        // is signed in without a window.
+        try {
+            if (this.context) {
+                const cookies = await this.context.cookies();
+                const session = cookies.filter((c) => c.expires === -1 || c.expires < 0);
+                if (session.length) {
+                    const keepUntil = Math.floor((Date.now() + 15552000000) / 1000);
+                    await this.context.addCookies(session.map((c) => ({
+                        name: c.name,
+                        value: c.value,
+                        domain: c.domain,
+                        path: c.path,
+                        httpOnly: c.httpOnly,
+                        secure: c.secure,
+                        sameSite: c.sameSite,
+                        expires: keepUntil,
+                    })));
+                }
+            }
+        }
+        catch { }
         try {
             if (this.context)
                 await this.context.close();

package/dist/commands.js

@@ -1,4 +1,4 @@
-import { providerLabel } from './providers.js';
+import { providerLabel, providerHasModelPicker } from './providers.js';
 import path from 'path';
 import os from 'os';
 import { isImageName } from './attachments.js';
@@ -322,8 +322,19 @@ export function renderDoctor(d, t = translate('en')) {
         row(true, 'git remote', d.hasOrigin ? t('doctor.origin_ok') : t('doctor.origin_none'));
     }
     if (typeof d.minSendIntervalMs === 'number') {
-        row(d.minSendIntervalMs > 0, 'send pause', t('doctor.send_pause', {
-            n: String(Math.round(d.minSendIntervalMs / 1000)),
+        // An adaptive provider legitimately sits at 0 (it backs off only after a
+        // REAL limit), so 0 must not be a WARN there.
+        row(d.minSendIntervalMs > 0 || !!d.adaptiveThrottle, 'send pause', d.adaptiveThrottle
+            ? t('doctor.adaptive_pause', {
+                n: String(Math.round(d.minSendIntervalMs / 1000)),
+            })
+            : t('doctor.send_pause', {
+                n: String(Math.round(d.minSendIntervalMs / 1000)),
+            }));
+    }
+    if (typeof d.displayAvailable === 'boolean') {
+        row(d.displayAvailable, 'display', t('doctor.display', {
+            v: d.displayAvailable ? t('common.on') : t('common.off'),
         }));
     }
     if (typeof d.sshRemote === 'boolean') {
@@ -342,9 +353,12 @@ export function renderDoctor(d, t = translate('en')) {
         const summary = missing.length === 0
             ? t('doctor.ui_ok')
             : missingCritical.length > 0
-                ? t('doctor.ui_broken', { v: missingCritical.join(', ') })
+                ? t('doctor.ui_broken', {
+                    v: missingCritical.join(', '),
+                    provider: providerLabel(d.provider || 'deepseek'),
+                })
                 : t('doctor.ui_degraded', { v: missing.join(', ') });
-        row(missing.length === 0, 'deepseek ui', summary);
+        row(missing.length === 0, providerLabel(d.provider || 'deepseek').toLowerCase() + ' ui', summary);
     }
     return t('doctor.title') + NL + rows.join(NL);
 }
@@ -1105,9 +1119,11 @@ export const SLASH_COMMANDS = [
 export function buildSlashCommandHints(opts) {
     const { devMode, t } = opts;
     const table = opts.commands ?? SLASH_COMMANDS;
-    // `/model` picks a QWEN model; DeepSeek has no such command. Hide it unless
-    // the Qwen provider is active (or the caller did not pass a provider).
-    const hideModel = opts.provider !== undefined && opts.provider !== 'qwen';
+    // `/model` needs a provider with a MODEL PICKER (Qwen, GLM); DeepSeek has
+    // none. The capability flag is the registry's, so a new backend only
+    // declares it once. Hide it unless such a provider is active (or the caller
+    // did not pass a provider).
+    const hideModel = opts.provider !== undefined && !providerHasModelPicker(opts.provider);
     const base = table
         .filter((c) => devMode || !isDevOnlyCommand(c.name))
         .filter((c) => !(hideModel && c.name === '/model'))

package/dist/config.js

@@ -38,6 +38,24 @@ export const DEFAULTS = {
         // give it generous room. A signed-in session answers in seconds; this only
         // bounds the worst case.
         answerTimeoutMs: 900000,
+        // Qwen's credentials live HERE, not in browser.auth: sharing one pair
+        // meant a DeepSeek login was typed into the Qwen form.
+        auth: { username: '', password: '', saveSession: true },
+        // Adaptive throttling is a later step for Qwen (its fixed 4 s gap is
+        // measured and works); telemetry is still recorded.
+        adaptiveThrottle: false,
+    },
+    glm: {
+        model: '',
+        // GLM windows are per-model; the default matches GLM-5.3-Flash (128K).
+        // `/model` re-derives it from the picked id (glmContextWindow).
+        contextLimit: 128_000,
+        // The operator's decision: no fixed pause for GLM. The adaptive throttle
+        // (on by default) reacts to a REAL rate limit instead.
+        minSendIntervalMs: 0,
+        answerTimeoutMs: 300000,
+        auth: { username: '', password: '', saveSession: true },
+        adaptiveThrottle: true,
     },
     // Headless by default: the browser runs without a visible window. Set
     // headless: false (or pass --headed) to watch/debug the page.
@@ -70,6 +88,9 @@ export const DEFAULTS = {
         maxIncompleteRetries: 4,
         incompleteWaitMs: 2000,
         autoContinue: true,
+        // How long the interactive sign-in window waits for the operator before it
+        // gives up (a captcha is solved by hand, so this is generous).
+        loginTimeoutMs: 600000,
         continueMinGapMs: 1500,
         // The agent-loop watchdog for ONE ask(). It only bounds a SILENT send:
         // a turn the server already ENDED with no answer (FINISHED + truncated
@@ -77,8 +98,16 @@ export const DEFAULTS = {
         // not waited out. 240s used to mean a 4-minute spinner per dead turn.
         askDeadlineMs: 120000,
         maxAfterToolRetries: 6,
-        autoCompact: false,
-        autoCompactPct: 95,
+        // Auto-compact is ON by default: a provider's context window is small and
+        // per-model (GLM: 32k-128k), and running out of it mid-task is a hard stop
+        // that loses the work, while a compaction at a safe seam only costs one
+        // extra send. The threshold is 85 rather than the old 95 because ONE large
+        // tool result can overflow the window before the seam is reached. The loop
+        // already guards the dangerous cases: it never compacts mid-generation or
+        // during a rate-limit wait, and it disables itself for the rest of the
+        // task if the fresh chat did not actually open.
+        autoCompact: true,
+        autoCompactPct: 85,
         resendPromptOnResume: false,
         // Subagents on by default: the Task tool is what keeps heavy exploration
         // out of the main context, and the main chat is restored afterwards.
@@ -86,6 +115,7 @@ export const DEFAULTS = {
         maxSubagents: 3,
         deepThinking: false,
         webSearch: true,
+        sendTelemetry: true,
         auth: {
             username: '',
             password: '',
@@ -149,6 +179,8 @@ export function loadConfig() {
 export function providerAskDeadlineMs(cfg) {
     if (cfg.provider === 'qwen')
         return cfg.qwen.answerTimeoutMs + 120_000;
+    if (cfg.provider === 'glm')
+        return cfg.glm.answerTimeoutMs + 120_000;
     return cfg.browser.askDeadlineMs;
 }
 function deepMerge(target, source) {
@@ -236,6 +268,34 @@ export const CONFIG_SCHEMA = [
         labelKey: 'cfg.f.browser_authSaveSession',
         groupKey: 'cfg.group.browser',
     },
+    // Each non-DeepSeek provider owns its credentials, so a DeepSeek login is
+    // never typed into a Qwen/GLM form (and vice versa). They MUST be in the
+    // schema: writeConfigValue rejects an unknown key, which silently dropped
+    // every GLM/Qwen credential saved from the login window.
+    {
+        path: 'qwen.auth.username',
+        type: 'string',
+        labelKey: 'cfg.f.qwen_authUsername',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'qwen.auth.password',
+        type: 'string',
+        labelKey: 'cfg.f.qwen_authPassword',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'glm.auth.username',
+        type: 'string',
+        labelKey: 'cfg.f.glm_authUsername',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'glm.auth.password',
+        type: 'string',
+        labelKey: 'cfg.f.glm_authPassword',
+        groupKey: 'cfg.group.browser',
+    },
     {
         path: 'provider',
         type: 'enum',
@@ -273,6 +333,36 @@ export const CONFIG_SCHEMA = [
         labelKey: 'cfg.f.qwen_answerTimeoutMs',
         groupKey: 'cfg.group.browser',
     },
+    {
+        path: 'glm.model',
+        type: 'string',
+        labelKey: 'cfg.f.glm_model',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'glm.contextLimit',
+        type: 'number',
+        min: 10_000,
+        max: 10_000_000,
+        labelKey: 'cfg.f.glm_contextLimit',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'glm.minSendIntervalMs',
+        type: 'number',
+        min: 0,
+        max: 600000,
+        labelKey: 'cfg.f.glm_minSendIntervalMs',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'glm.answerTimeoutMs',
+        type: 'number',
+        min: 1000,
+        max: 3600000,
+        labelKey: 'cfg.f.glm_answerTimeoutMs',
+        groupKey: 'cfg.group.browser',
+    },
     {
         path: 'debug',
         type: 'boolean',
@@ -405,6 +495,20 @@ export const CONFIG_SCHEMA = [
         labelKey: 'cfg.f.browser_autoContinue',
         groupKey: 'cfg.group.browser',
     },
+    {
+        path: 'browser.sendTelemetry',
+        type: 'boolean',
+        labelKey: 'cfg.f.browser_sendTelemetry',
+        groupKey: 'cfg.group.browser',
+    },
+    {
+        path: 'browser.loginTimeoutMs',
+        type: 'number',
+        min: 30_000,
+        max: 3_600_000,
+        labelKey: 'cfg.f.browser_loginTimeoutMs',
+        groupKey: 'cfg.group.browser',
+    },
     {
         path: 'browser.continueMinGapMs',
         type: 'number',