zames_pro 2.80.8 → 2.81.1

package/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.81.1] - 2026-10-21
+
+### Added
+
+- send telemetry is opt-in (on automatically in dev)
+
+### Fixed
+
+- **config:** mask a password in the /config set confirmation
+
+### Changed
+
+- apply prettier to the GLM provider and send runtime
+
+## [2.81.0] - 2026-10-21
+
+### Added
+
+- auto-compact by default, GLM reasoning effort low
+- **glm:** tell the model it runs on the operator's machine; fix the runtime rewrite URL match
+- **glm:** neutralise z.ai's agent runtime so zames tools actually run
+- **glm:** run with a visible browser by default (the site blocks headless)
+- **glm:** thinking is always on and cannot be toggled off
+- **glm:** verify mode flags and attach files through the upload button
+- send telemetry for all providers and adaptive throttle (enabled for GLM)
+- GLM (chat.z.ai) provider with anonymized recon fixtures
+- browser-based login (auto-login first, headed window fallback, headless after)
+
+### Fixed
+
+- **glm:** force web search off and report a busy page instead of a missing button
+- **glm:** no web-search noise, quota fails fast, the model is told not to browse
+- **glm:** the smoke sends the system-prompt into the same chat; the mode check reads the rewritten body
+- **glm:** a signed-in session is not reported as a guest
+- drop the unused headless flag
+- **glm:** word the mode warning accurately (the smoke passed with it on)
+- persist the sign-in session cookie so it survives a restart
+- a successful auto-login saves the credentials it used
+- per-provider credentials are writable (missing from the config schema)
+- DeepSeek signs in through the browser window before the terminal form
+- the TUI login fallback prefills the active provider's credentials
+- doctor renders the display row and the adaptive pause
+- **glm:** report the slider captcha instead of a silent no-answer
+- handoff label and live config for more than two providers
+- per-provider auth marker, credentials and shared headless-UA cache
+
+### Changed
+
+- provider capabilities instead of qwen-only checks
+
 ## [2.80.8] - 2026-10-20
 
 ### Changed

package/README.md

@@ -65,8 +65,9 @@ zames does not call the model API. It launches a headless Chromium with a
 persistent profile, signs in to a chat web app like a human, types the task
 into the chat box, and reads the answer back.
 
-Two chat backends are available, switched with `/provider <deepseek|qwen>`:
-**DeepSeek** (`chat.deepseek.com`, the default) and **Qwen** (`chat.qwen.ai`).
+Three chat backends are available, switched with `/provider <deepseek|qwen|glm>`:
+**DeepSeek** (`chat.deepseek.com`, the default), **Qwen** (`chat.qwen.ai`)
+and **GLM** (`chat.z.ai`).
 The switch is **live** — zames closes the current backend and opens the other
 one in place, no restart needed. Each keeps its own persistent profile
 (`~/.zames/profile` and `~/.zames/qwen-profile`), so switching never signs the
@@ -97,7 +98,7 @@ Key pieces:
 
 - [Quick start](#quick-start) · [Features](#features) · [Why zames?](#why-zames) · [Requirements](#requirements)
 - [How it works](#how-it-works) · [Installation](#installation) · [Signing in](#signing-in) · [Usage](#usage)
-- [Switching providers (DeepSeek / Qwen)](#switching-providers-deepseek--qwen)
+- [Switching providers (DeepSeek / Qwen / GLM)](#switching-providers-deepseek--qwen--glm)
 - [Tools](#tools) · [Slash commands](#slash-commands)
 - [Project context, skills and memory](#project-context-skills-and-memory) · [MCP (external tools)](#mcp-external-tools) · [Configuration](#configuration)
 - [FAQ](#faq) · [Links](#links) · [License](#license)
@@ -152,13 +153,18 @@ Key pieces:
 The browser runs **headless by default**. When the active backend requires a
 sign-in, zames:
 
-1. reuses the session stored in the persistent profile (`~/.zames/profile` for
-   DeepSeek, `~/.zames/qwen-profile` for Qwen) if it is still valid;
+1. reuses the session stored in the persistent profile
+   (`~/.zames/profile`, `~/.zames/qwen-profile` or `~/.zames/glm-profile`)
+   if it is still valid;
 2. otherwise signs in automatically with the saved credentials
-   (`browser.auth.username` / `browser.auth.password`);
-3. otherwise asks you for the login/password in the terminal (in a TTY) and,
-   after a successful sign-in, remembers them for next time;
-4. otherwise falls back to a manual sign-in hint.
+   (`browser.auth.username` / `browser.auth.password` for DeepSeek,
+   `qwen.auth.*` / `glm.auth.*` for the others);
+3. otherwise opens a **visible browser window** so YOU sign in there — a
+   captcha (DeepSeek and z.ai both use one) cannot be typed into a terminal.
+   zames notices the sign-in and returns to headless; the credentials you
+   typed are saved for the next silent auto-login;
+4. only when no window can be shown (no display, a non-interactive run) does it
+   fall back to the terminal form.
 
 To sign in by hand (for example, if the site shows a captcha), run with a
 visible window:
@@ -178,7 +184,7 @@ version). You do not need `--headed` just to log in.
 Credentials and toggles can also be edited from `/config`
 (`browser.auth.username`, `browser.auth.password`, `browser.auth.saveSession`).
 
-## Switching providers (DeepSeek / Qwen)
+## Switching providers (DeepSeek / Qwen / GLM)
 
 zames can drive either **DeepSeek** (`chat.deepseek.com`, the default) or
 **Qwen** (`chat.qwen.ai`):
@@ -206,6 +212,25 @@ Notes:
   GitHub — no phone required). zames auto-logins from the saved credentials or
   asks in the terminal, exactly like DeepSeek. `/model` changes the Qwen model
   at runtime.
+- **GLM** (`chat.z.ai`) is the third backend. Its first message from a fresh
+  profile is gated by a slider captcha, so sign in once in the visible window;
+  after that the stored session is reused. `/model` lists and picks GLM
+  models too.
+- **GLM runs with a VISIBLE browser window.** Measured: the SAME signed-in
+  session is fine in a headed window but every send from HEADLESS is stopped by
+  the site's slider captcha (a different puzzle each time, so it cannot be
+  solved programmatically). zames therefore launches GLM headed by default and
+  prints a note about it; `--headless` still forces headless (sends will hit
+  the captcha). `--headed` is accepted everywhere.
+- **Send telemetry**: every send is recorded in
+  `~/.zames/logs/sends-<provider>.jsonl` (timing, mode flags, the outcome and
+  the server error — never the prompt or the answer). Turn it off with
+  `/config set browser.sendTelemetry false`. `/limits` shows the recent sends
+  and the current pause. GLM additionally uses an **adaptive pause**: it starts
+  at 0 and backs off from a REAL rate limit.
+- **Warning**: automating a web chat may violate the service's terms of use and
+  can get an account blocked. GLM (z.ai) has an official API — prefer it for
+  heavy automation.
 - File attachments on Qwen go through the mode menu's **Upload attachment**
   item; DeepSeek uses its own paperclip.
 - `/doctor` shows the active provider and the UI health of that provider's
@@ -648,11 +673,14 @@ zames не вызывает API модели. Он запускает headless C
 профилем, входит в веб-чат как человек, печатает задачу в поле чата и читает
 ответ обратно.
 
-Доступны два бэкенда, переключаются командой `/provider <deepseek|qwen>`:
-**DeepSeek** (`chat.deepseek.com`, по умолчанию) и **Qwen** (`chat.qwen.ai`).
+Доступны три бэкенда, переключаются командой
+`/provider <deepseek|qwen|glm>`:
+**DeepSeek** (`chat.deepseek.com`, по умолчанию), **Qwen** (`chat.qwen.ai`)
+и **GLM** (`chat.z.ai`).
 Переключение **живое** — zames закрывает текущий бэкенд и открывает другой на
 месте, без перезапуска. У каждого свой постоянный профиль
-(`~/.zames/profile` и `~/.zames/qwen-profile`), поэтому переключение не
+(`~/.zames/profile`, `~/.zames/qwen-profile`, `~/.zames/glm-profile`),
+поэтому переключение не
 разлогинивает другой.
 
 <p align="center">
@@ -682,7 +710,7 @@ zames не вызывает API модели. Он запускает headless C
 
 - [Быстрый старт](#быстрый-старт) · [Возможности](#возможности) · [Почему zames?](#почему-zames) · [Требования](#требования)
 - [Как это работает](#как-это-работает) · [Установка](#установка) · [Вход в аккаунт](#вход-в-аккаунт) · [Использование](#использование)
-- [Переключение провайдера (DeepSeek / Qwen)](#переключение-провайдера-deepseek--qwen)
+- [Переключение провайдера (DeepSeek / Qwen / GLM)](#переключение-провайдера-deepseek--qwen--glm)
 - [Инструменты](#инструменты) · [Слэш-команды](#слэш-команды)
 - [Контекст проекта, навыки и память](#контекст-проекта-навыки-и-память) · [MCP (внешние инструменты)](#mcp-внешние-инструменты) · [Конфигурация](#конфигурация)
 - [FAQ](#faq) · [Ссылки](#ссылки) · [Лицензия](#лицензия)
@@ -740,13 +768,17 @@ zames не вызывает API модели. Он запускает headless C
 Браузер по умолчанию работает **headless**. Когда активный бэкенд требует
 входа, zames:
 
-1. переиспользует сессию из постоянного профиля (`~/.zames/profile` для
-   DeepSeek, `~/.zames/qwen-profile` для Qwen), если она ещё валидна;
+1. переиспользует сессию из постоянного профиля
+   (`~/.zames/profile`, `~/.zames/qwen-profile` или `~/.zames/glm-profile`),
+   если она ещё валидна;
 2. иначе входит автоматически по сохранённым учётным данным
-   (`browser.auth.username` / `browser.auth.password`);
-3. иначе спрашивает логин/пароль в терминале (в TTY) и после успешного входа
-   запоминает их для следующего раза;
-4. иначе показывает подсказку про ручной вход.
+   (`browser.auth.*` у DeepSeek, `qwen.auth.*` / `glm.auth.*` у остальных);
+3. иначе открывает **видимое окно браузера**, чтобы вы вошли сами — капчу
+   (она есть и у DeepSeek, и у z.ai) в терминал не ввести. zames замечает
+   вход и возвращается в headless; введённые вами учётные данные сохраняются
+   для следующего тихого автовхода;
+4. и только если окно показать нельзя (нет дисплея, неинтерактивный запуск),
+   переходит к форме в терминале.
 
 Чтобы войти руками (например, если сайт показывает капчу), запустите с
 видимым окном:
@@ -766,7 +798,7 @@ Headless работает из коробки: headless Chrome обычно пр
 Учётные данные и переключатели можно также править из `/config`
 (`browser.auth.username`, `browser.auth.password`, `browser.auth.saveSession`).
 
-## Переключение провайдера (DeepSeek / Qwen)
+## Переключение провайдера (DeepSeek / Qwen / GLM)
 
 zames умеет работать с **DeepSeek** (`chat.deepseek.com`, по умолчанию) и
 **Qwen** (`chat.qwen.ai`):
@@ -793,6 +825,24 @@ zames умеет работать с **DeepSeek** (`chat.deepseek.com`, по у
   несколько сообщений в день; для долгих прогонов войдите (email / Google /
   GitHub — телефон не нужен). zames сам логинится по сохранённым кредам или
   спросит в терминале, как и с DeepSeek. `/model` меняет модель Qwen на лету.
+- **GLM** (`chat.z.ai`) — третий бэкенд. Первое сообщение с нового
+  профиля закрыто капчей-слайдером, поэтому войдите один раз в видимом окне;
+  дальше сохранённая сессия переиспользуется. `/model` работает и для GLM.
+- **GLM работает с ВИДИМЫМ окном браузера.** Замерено: одна и та же
+  залогиненная сессия в окне отправляет нормально, а КАЖДАЯ отправка из
+  headless упирается в капчу-слайдер сайта (картинка каждый раз новая, поэтому
+  программно её не пройти). Поэтому zames запускает GLM с окном по умолчанию и
+  пишет об этом при старте; `--headless` по-прежнему форсирует headless
+  (отправки будут упираться в капчу). `--headed` работает везде.
+- **Телеметрия отправок**: каждая отправка пишется в
+  `~/.zames/logs/sends-<provider>.jsonl` (тайминги, флаги режимов, исход и
+  ошибка сервера — без промптов и ответов). Отключается через
+  `/config set browser.sendTelemetry false`. Команда `/limits` показывает
+  последние отправки и текущую паузу. У GLM вдобавок **адаптивная пауза**: она
+  начинается с 0 и растёт только после НАСТОЯЩЕГО лимита.
+- **Предупреждение**: автоматизация веб-чата может нарушать условия
+  использования сервиса и привести к блокировке аккаунта. У GLM (z.ai) есть
+  официальный API — для тяжёлой автоматизации лучше он.
 - Вложения в Qwen идут через пункт **Upload attachment** в меню режима; в
   DeepSeek — своя скрепка.
 - `/doctor` показывает активный провайдер и состояние UI его страницы.

package/dist/browser-login.js

@@ -0,0 +1,179 @@
+// Interactive, BROWSER-BASED sign-in — shared by every provider.
+//
+// WHY: DeepSeek (and now z.ai) often answers a headless login with a captcha
+// that neither a terminal prompt nor a filled form can pass. A human has to
+// sign in inside a VISIBLE window; zames then notices the session and goes
+// back to headless. Before this module each provider had its own ad-hoc flow,
+// so the policy lived in three places and none of them offered the window.
+//
+// The module is PURE in the sense that it owns NO Playwright and NO disk: the
+// browser supplies `probeLogin`, `relaunch`, `openLoginPage`, ... and the
+// decision sequence below is unit-tested with injected doubles
+// (test/browser-login.test.ts).
+//
+// Order (the operator's requirement):
+//   1. probeLogin() === 'in'            -> done, no window at all
+//   2. autoLogin() with saved creds     -> done (this is the FIRST step after
+//                                          the probe; credentials are permanent)
+//   3. guest is allowed and no login was requested -> work as a guest
+//   4. not interactive                  -> LoginRequiredError (fast, no window)
+//   5. no display                       -> fall back to the in-TUI forms
+//   6. headless                         -> relaunchSafe(headed), sign in
+//   7. wait until probeLogin() === 'in' (poll), the operator closes the window
+//      (= done) or presses Esc (= cancel)
+//   8. save credentials captured from the form, persist the session marker
+//   9. not stayHeaded                   -> relaunchSafe(headless); if the
+//                                          session did not carry over, go back
+//                                          to headed ONCE and stay there.
+/** A sign-in is required and no interactive window can be offered. */
+export class LoginRequiredError extends Error {
+    constructor(provider) {
+        super(provider + ': a sign-in is required (non-interactive)');
+        this.name = 'LoginRequiredError';
+    }
+}
+/** The operator cancelled the sign-in (Esc / Ctrl+C). */
+export class LoginCancelledError extends Error {
+    constructor() {
+        super('sign-in cancelled');
+        this.name = 'LoginCancelledError';
+    }
+}
+export async function interactiveBrowserLogin(deps) {
+    // 1) A live session: nothing to do (and no window flashes).
+    const first = await deps.probeLogin().catch(() => 'unknown');
+    if (first === 'in')
+        return 'already';
+    // 2) Saved credentials — the FIRST fallback. They are permanent (the
+    //    operator's decision), so a logged-out profile signs in silently.
+    const auto = await deps.autoLogin().catch(() => false);
+    if (auto) {
+        await deps.persistSession().catch(() => { });
+        return 'auto';
+    }
+    // 3) A guest is usable and no window is needed.
+    if (deps.guestAllowed)
+        return 'guest';
+    // 4) Non-interactive: fail fast instead of hanging on a window nobody sees.
+    if (!deps.interactive)
+        throw new LoginRequiredError(deps.provider);
+    // 5) No display: the in-TUI form is the accepted fallback (DESIGN-NOTES
+    //    "Login stays inside the TUI").
+    if (!deps.canShowWindow) {
+        if (deps.tuiLogin) {
+            const ok = await deps.tuiLogin().catch(() => false);
+            if (ok) {
+                await deps.persistSession().catch(() => { });
+                return 'tui';
+            }
+        }
+        throw new LoginRequiredError(deps.provider);
+    }
+    // 6) Open the visible window and wait for the human.
+    const inWindow = await runHeadedLogin(deps);
+    if (!inWindow) {
+        if (deps.isAborted())
+            throw new LoginCancelledError();
+        throw new LoginRequiredError(deps.provider);
+    }
+    await deps.persistSession().catch(() => { });
+    // 7) Back to headless unless the operator asked for a visible window.
+    if (!deps.stayHeaded) {
+        await deps.relaunch(false).catch(() => { });
+        const back = await deps.probeLogin().catch(() => 'unknown');
+        if (back !== 'in') {
+            // The session did not carry over (a session cookie or an SPA token was
+            // lost on the relaunch). Stay visible ONCE — never loop.
+            await deps.relaunch(true).catch(() => { });
+            deps.notice('login.headless_failed');
+        }
+    }
+    await deps.gotoChat().catch(() => { });
+    return 'window';
+}
+/**
+ * Show the window, drive the human through the sign-in and return true when
+ * the session became active (or the operator closed the window = "done").
+ */
+async function runHeadedLogin(deps) {
+    if (!deps.stayHeaded)
+        await deps.relaunch(true).catch(() => { });
+    await deps.openLoginPage().catch(() => { });
+    await deps.prefill().catch(() => { });
+    await deps.captureCredentials().catch(() => { });
+    deps.notice('login.browser_prompt');
+    const deadline = deps.now() + deps.timeoutMs;
+    while (deps.now() < deadline) {
+        if (deps.isAborted())
+            return false;
+        const r = await deps.probeLogin().catch(() => 'unknown');
+        if (r === 'in')
+            return true;
+        // A closed window is the operator's "I am done" signal: the browser object
+        // may still hold the session cookies, so verify once more and accept.
+        if (deps.windowClosed()) {
+            deps.notice('login.window_closed');
+            const again = await deps
+                .probeLogin()
+                .catch(() => 'unknown');
+            return again === 'in';
+        }
+        await deps.sleep(1000);
+    }
+    deps.notice('login.timeout');
+    const last = await deps.probeLogin().catch(() => 'unknown');
+    return last === 'in';
+}
+/**
+ * PURE: can a browser window be shown? Only a PRELIMINARY filter — WSL2 often
+ * exports DISPLAY/WAYLAND_DISPLAY even when WSLg is broken, so the headed
+ * launch itself must still be wrapped in try/catch with a timeout.
+ */
+export function canShowWindow(env, platform) {
+    if (env.ZAMES_NONINTERACTIVE_LOGIN === '1')
+        return false;
+    if (env.CI === 'true' || env.CI === '1')
+        return false;
+    if (platform === 'win32' || platform === 'darwin')
+        return true;
+    // Linux/X11/Wayland: a display variable must be set.
+    if (env.DISPLAY || env.WAYLAND_DISPLAY)
+        return true;
+    return false;
+}
+/**
+ * PURE: is this run allowed to open an interactive window at all? One-shot
+ * (--task), a scheduler job and a non-TTY all say no; the env kill switch
+ * ZAMES_NONINTERACTIVE_LOGIN=1 says no too (the smoke scripts set it so a
+ * cold login fails fast instead of hanging).
+ */
+export function loginIsInteractive(opts) {
+    if (opts.env.ZAMES_NONINTERACTIVE_LOGIN === '1')
+        return false;
+    if (opts.oneShot)
+        return false;
+    if (opts.scheduled)
+        return false;
+    return opts.isTTY;
+}
+/**
+ * PURE: classify a login state from the cheap signals. The rule that matters
+ * is that the INPUT FIELD alone proves nothing: a guest sees it too, so the
+ * classifier relies on the API role / a token / an explicit sign-in control.
+ */
+export function classifyLoginProbe(input) {
+    const role = String(input.role || '').toLowerCase();
+    if (role === 'user' || role === 'admin')
+        return 'in';
+    if (role === 'guest')
+        return input.signInVisible ? 'out' : 'in';
+    if (input.captcha)
+        return 'challenge';
+    if (input.hasToken === true)
+        return 'in';
+    if (input.hasToken === false)
+        return 'out';
+    if (input.signInVisible)
+        return 'out';
+    return 'unknown';
+}

package/dist/browser-pure.js

@@ -106,23 +106,49 @@ export const USER_DATA_DIR = path.join(os.homedir(), '.zames', 'profile');
 // relaunch" dance happens only once (it otherwise doubled every headless
 // start). Keying by the executable path means a Playwright update (new engine
 // path) invalidates the cache and we re-derive the UA once for the new build.
+//
+// The cache holds ONE entry PER ENGINE, not per provider: the UA depends on
+// the browser build, not on the site. It used to be a single {engine,ua}
+// record with providers appending a suffix (`engine:qwen`), so each provider
+// overwrote the other's entry and a /provider switch relaunched the browser
+// once per side. The file now maps engine key -> UA; a legacy single record is
+// still read.
 const HEADLESS_UA_CACHE = path.join(os.homedir(), '.zames', 'headless-ua.json');
 // Pure: pick a reusable UA from the cache file's text for the given engine, or
 // null. Exported so the policy is unit-tested without touching ~/.zames.
 export function parseHeadlessUACache(raw, engine) {
     try {
         const j = JSON.parse(raw);
-        if (j &&
-            j.engine === engine &&
-            typeof j.ua === 'string' &&
-            j.ua &&
-            !/Headless/i.test(j.ua)) {
-            return j.ua;
-        }
+        if (!j || typeof j !== 'object')
+            return null;
+        const fromMap = j.engines && typeof j.engines === 'object' ? j.engines[engine] : '';
+        const legacy = j.engine === engine ? j.ua : '';
+        const ua = fromMap || legacy;
+        if (typeof ua === 'string' && ua && !/Headless/i.test(ua))
+            return ua;
     }
     catch { }
     return null;
 }
+// Pure: merge a UA into the cache file's text, keeping every OTHER engine's
+// entry. Exported so the multi-engine contract is unit-tested.
+export function mergeHeadlessUACache(raw, engine, ua) {
+    let engines = {};
+    try {
+        const j = JSON.parse(raw);
+        if (j && j.engines && typeof j.engines === 'object') {
+            engines = { ...j.engines };
+        }
+        else if (j && typeof j.engine === 'string' && typeof j.ua === 'string') {
+            // Migrate a legacy single record into the map.
+            engines[j.engine] = j.ua;
+        }
+    }
+    catch { }
+    if (engine)
+        engines[engine] = ua;
+    return JSON.stringify({ engines }, null, 2);
+}
 export function headlessEngineKey() {
     try {
         return chromium.executablePath();
@@ -147,7 +173,12 @@ export async function writeCachedHeadlessUA(engine, ua) {
         return;
     try {
         await fs.mkdir(path.dirname(HEADLESS_UA_CACHE), { recursive: true });
-        await fs.writeFile(HEADLESS_UA_CACHE, JSON.stringify({ engine, ua }, null, 2), 'utf-8');
+        let prev = '';
+        try {
+            prev = await fs.readFile(HEADLESS_UA_CACHE, 'utf-8');
+        }
+        catch { }
+        await fs.writeFile(HEADLESS_UA_CACHE, mergeHeadlessUACache(prev, engine, ua), 'utf-8');
     }
     catch { }
 }
@@ -169,7 +200,80 @@ export function sanitizeHeadlessUA(ua) {
 }
 // Written after a successful sign-in so the next launch knows a session was
 // stored in the persistent profile (used by /doctor and diagnostics).
+//
+// The marker is PER PROVIDER (`{ providers: { deepseek: {at}, qwen: {at} } }`).
+// It used to be one shared file: Qwen wrote `{provider:'qwen'}` and DeepSeek a
+// bare `{at}`, each overwriting the other, so /doctor and the startup banner
+// reported "no session" for whichever provider had signed in second. A legacy
+// record without `providers` still reads: `{provider:'qwen'}` means Qwen and a
+// bare `{at}` means DeepSeek (the only writer before the second backend).
 export const AUTH_MARKER_FILE = path.join(os.homedir(), '.zames', 'auth.json');
+/**
+ * PURE: does the marker text say `provider` has a stored session? Legacy
+ * shapes are honored (see the comment above AUTH_MARKER_FILE).
+ */
+export function authMarkerHas(raw, provider) {
+    if (!raw)
+        return false;
+    let j;
+    try {
+        j = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    if (!j || typeof j !== 'object')
+        return false;
+    if (j.providers && typeof j.providers === 'object') {
+        return !!j.providers[provider];
+    }
+    if (typeof j.provider === 'string')
+        return j.provider === provider;
+    // Legacy DeepSeek marker: a bare `{at}` with no provider field.
+    return provider === 'deepseek' && typeof j.at === 'string';
+}
+/**
+ * PURE: merge a "signed in at" timestamp for `provider` into the marker text,
+ * KEEPING every other provider's entry. A legacy record is migrated.
+ */
+export function mergeAuthMarker(raw, provider, at) {
+    const providers = {};
+    try {
+        const j = JSON.parse(raw);
+        if (j && j.providers && typeof j.providers === 'object') {
+            for (const [k, v] of Object.entries(j.providers))
+                providers[k] = v || {};
+        }
+        else if (j && typeof j === 'object') {
+            if (j.provider === 'qwen')
+                providers.qwen = { at: j.at };
+            else if (typeof j.at === 'string')
+                providers.deepseek = { at: j.at };
+        }
+    }
+    catch { }
+    providers[provider] = { at };
+    return JSON.stringify({ providers }, null, 2);
+}
+// Best-effort: read the marker text from disk ('' when absent/unreadable).
+export async function readAuthMarker() {
+    try {
+        return await fs.readFile(AUTH_MARKER_FILE, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+// Best-effort: mark `provider` as signed in, keeping the other providers'
+// entries. Never throws (a marker is informational, not load-bearing).
+export async function writeAuthMarker(provider) {
+    try {
+        await fs.mkdir(path.dirname(AUTH_MARKER_FILE), { recursive: true });
+        const prev = await readAuthMarker();
+        await fs.writeFile(AUTH_MARKER_FILE, mergeAuthMarker(prev, provider, new Date().toISOString()), 'utf-8');
+    }
+    catch { }
+}
 export function isGenerationIncompleteText(text) {
     const t = String(text || '');
     return (GENERATION_ERR_RE.test(t) ||