qwenproxy-cli 1.0.0 → 1.0.2

package/src/services/auth-playwright.ts

@@ -1,173 +1,173 @@
-import { AuthError } from "../core/errors.ts";
-import { getAccountCredentials, loadAccounts } from "../core/accounts.ts";
-import { config } from "../core/config.ts";
-import {
-  getBasicHeaders as getPlaywrightBasicHeaders,
-  initPlaywrightForAccount,
-  isPlaywrightInitialized,
-  refreshHeaders,
-} from "./playwright.ts";
-
-export interface HeaderResult {
-  headers: Record<string, string>;
-  chatSessionId: string;
-  parentMessageId: string | null;
-}
-
-export function isAuthMockEnabled(): boolean {
-  return (
-    process.env.TEST_MOCK_QWEN_AUTH === "true" &&
-    process.env.NODE_ENV !== "production"
-  );
-}
-
-function isRunningUnderNodeTest(): boolean {
-  return process.argv.some(
-    (arg) =>
-      arg === "--test" ||
-      arg.includes("src/tests/") ||
-      arg.includes("src\\tests\\"),
-  );
-}
-
-async function ensurePlaywrightInitialized(accountId: string): Promise<void> {
-  if (isPlaywrightInitialized(accountId)) return;
-
-  if (isRunningUnderNodeTest()) {
-    throw new Error(`Playwright not initialized for account: ${accountId}`);
-  }
-
-  const credentials = getAccountCredentials(accountId);
-  if (!credentials) {
-    throw new AuthError(`Qwen account ${accountId} is not configured.`);
-  }
-
-  await initPlaywrightForAccount(
-    credentials,
-    config.playwright.headless,
-    config.playwright.browser,
-  );
-
-  // Standby accounts are initialized lazily. Apply the same account-level
-  // settings that startup preparation would apply.
-  try {
-    const { disableNativeTools } = await import("./qwen.ts");
-    await disableNativeTools(accountId).catch(() => {});
-  } catch {
-    // Non-fatal: chat creation will still work with default account settings.
-  }
-}
-
-export async function getBasicHeaders(accountId?: string): Promise<{
-  cookie: string;
-  userAgent: string;
-  bxV: string;
-  bxUa: string;
-  bxUmidtoken: string;
-  secChUa: string;
-  secChUaMobile: string;
-  secChUaPlatform: string;
-  version: string;
-}> {
-  if (isAuthMockEnabled()) {
-    return {
-      cookie: "token=mock",
-      userAgent: "mock",
-      bxV: "2.5.37",
-      bxUa: "mock-bx-ua",
-      bxUmidtoken: "mock-bx-umidtoken",
-      secChUa: "",
-      secChUaMobile: "?0",
-      secChUaPlatform: "",
-      version: "0.2.89",
-    };
-  }
-
-  const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
-  if (!resolvedAccountId) {
-    throw new AuthError(
-      "No Qwen accounts configured. Add accounts with npm run login.",
-    );
-  }
-
-  await ensurePlaywrightInitialized(resolvedAccountId);
-  return getPlaywrightBasicHeaders(resolvedAccountId);
-}
-
-export function isTokenExpiringSoon(
-  cookie: string,
-  minutesBeforeExpiry = 5,
-): boolean {
-  const tokenMatch = cookie.match(/token=([^;]+)/);
-  if (!tokenMatch) return false;
-
-  try {
-    const token = decodeURIComponent(tokenMatch[1]);
-    const segments = token.split(".");
-    // Some Qwen deployments use opaque cookies. Treating those as expired
-    // forces expensive header capture on every personalization request.
-    if (segments.length !== 3 || !segments[1]) return false;
-
-    const payloadJson = Buffer.from(segments[1], "base64url").toString("utf-8");
-    const payload = JSON.parse(payloadJson);
-    const exp = payload.exp;
-    if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
-
-    const nowSec = Math.floor(Date.now() / 1000);
-    const thresholdSec = minutesBeforeExpiry * 60;
-    return exp - nowSec < thresholdSec;
-  } catch {
-    return false;
-  }
-}
-
-export async function getQwenHeaders(
-  forceNew = false,
-  accountId?: string,
-): Promise<HeaderResult> {
-  if (isAuthMockEnabled()) {
-    const basic = await getBasicHeaders(accountId);
-    return {
-      headers: {
-        cookie: basic.cookie,
-        "user-agent": basic.userAgent,
-        "bx-v": basic.bxV,
-        "bx-ua": basic.bxUa,
-        "bx-umidtoken": basic.bxUmidtoken,
-        version: basic.version,
-      },
-      chatSessionId: "",
-      parentMessageId: null,
-    };
-  }
-
-  const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
-  if (!resolvedAccountId) {
-    throw new AuthError(
-      "No Qwen accounts configured. Add accounts with npm run login.",
-    );
-  }
-
-  await ensurePlaywrightInitialized(resolvedAccountId);
-
-  if (forceNew) {
-    await refreshHeaders(resolvedAccountId);
-  }
-
-  const basic = await getPlaywrightBasicHeaders(resolvedAccountId);
-  return {
-    headers: {
-      cookie: basic.cookie,
-      "user-agent": basic.userAgent,
-      "bx-v": basic.bxV,
-      "bx-ua": basic.bxUa || "",
-      "bx-umidtoken": basic.bxUmidtoken || "",
-      "sec-ch-ua": basic.secChUa,
-      "sec-ch-ua-mobile": basic.secChUaMobile,
-      "sec-ch-ua-platform": basic.secChUaPlatform,
-      version: basic.version,
-    },
-    chatSessionId: "",
-    parentMessageId: null,
-  };
-}
+import { AuthError } from "../core/errors.ts";
+import { getAccountCredentials, loadAccounts } from "../core/accounts.ts";
+import { config } from "../core/config.ts";
+import {
+  getBasicHeaders as getPlaywrightBasicHeaders,
+  initPlaywrightForAccount,
+  isPlaywrightInitialized,
+  refreshHeaders,
+} from "./playwright.ts";
+
+export interface HeaderResult {
+  headers: Record<string, string>;
+  chatSessionId: string;
+  parentMessageId: string | null;
+}
+
+export function isAuthMockEnabled(): boolean {
+  return (
+    process.env.TEST_MOCK_QWEN_AUTH === "true" &&
+    process.env.NODE_ENV !== "production"
+  );
+}
+
+function isRunningUnderNodeTest(): boolean {
+  return process.argv.some(
+    (arg) =>
+      arg === "--test" ||
+      arg.includes("src/tests/") ||
+      arg.includes("src\\tests\\"),
+  );
+}
+
+async function ensurePlaywrightInitialized(accountId: string): Promise<void> {
+  if (isPlaywrightInitialized(accountId)) return;
+
+  if (isRunningUnderNodeTest()) {
+    throw new Error(`Playwright not initialized for account: ${accountId}`);
+  }
+
+  const credentials = getAccountCredentials(accountId);
+  if (!credentials) {
+    throw new AuthError(`Qwen account ${accountId} is not configured.`);
+  }
+
+  await initPlaywrightForAccount(
+    credentials,
+    config.playwright.headless,
+    config.playwright.browser,
+  );
+
+  // Standby accounts are initialized lazily. Apply the same account-level
+  // settings that startup preparation would apply.
+  try {
+    const { disableNativeTools } = await import("./qwen.ts");
+    await disableNativeTools(accountId).catch(() => {});
+  } catch {
+    // Non-fatal: chat creation will still work with default account settings.
+  }
+}
+
+export async function getBasicHeaders(accountId?: string): Promise<{
+  cookie: string;
+  userAgent: string;
+  bxV: string;
+  bxUa: string;
+  bxUmidtoken: string;
+  secChUa: string;
+  secChUaMobile: string;
+  secChUaPlatform: string;
+  version: string;
+}> {
+  if (isAuthMockEnabled()) {
+    return {
+      cookie: "token=mock",
+      userAgent: "mock",
+      bxV: "2.5.37",
+      bxUa: "mock-bx-ua",
+      bxUmidtoken: "mock-bx-umidtoken",
+      secChUa: "",
+      secChUaMobile: "?0",
+      secChUaPlatform: "",
+      version: "0.2.89",
+    };
+  }
+
+  const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
+  if (!resolvedAccountId) {
+    throw new AuthError(
+      "No Qwen accounts configured. Add accounts with npm run login.",
+    );
+  }
+
+  await ensurePlaywrightInitialized(resolvedAccountId);
+  return getPlaywrightBasicHeaders(resolvedAccountId);
+}
+
+export function isTokenExpiringSoon(
+  cookie: string,
+  minutesBeforeExpiry = 5,
+): boolean {
+  const tokenMatch = cookie.match(/token=([^;]+)/);
+  if (!tokenMatch) return false;
+
+  try {
+    const token = decodeURIComponent(tokenMatch[1]);
+    const segments = token.split(".");
+    // Some Qwen deployments use opaque cookies. Treating those as expired
+    // forces expensive header capture on every personalization request.
+    if (segments.length !== 3 || !segments[1]) return false;
+
+    const payloadJson = Buffer.from(segments[1], "base64url").toString("utf-8");
+    const payload = JSON.parse(payloadJson);
+    const exp = payload.exp;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+
+    const nowSec = Math.floor(Date.now() / 1000);
+    const thresholdSec = minutesBeforeExpiry * 60;
+    return exp - nowSec < thresholdSec;
+  } catch {
+    return false;
+  }
+}
+
+export async function getQwenHeaders(
+  forceNew = false,
+  accountId?: string,
+): Promise<HeaderResult> {
+  if (isAuthMockEnabled()) {
+    const basic = await getBasicHeaders(accountId);
+    return {
+      headers: {
+        cookie: basic.cookie,
+        "user-agent": basic.userAgent,
+        "bx-v": basic.bxV,
+        "bx-ua": basic.bxUa,
+        "bx-umidtoken": basic.bxUmidtoken,
+        version: basic.version,
+      },
+      chatSessionId: "",
+      parentMessageId: null,
+    };
+  }
+
+  const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
+  if (!resolvedAccountId) {
+    throw new AuthError(
+      "No Qwen accounts configured. Add accounts with npm run login.",
+    );
+  }
+
+  await ensurePlaywrightInitialized(resolvedAccountId);
+
+  if (forceNew) {
+    await refreshHeaders(resolvedAccountId);
+  }
+
+  const basic = await getPlaywrightBasicHeaders(resolvedAccountId);
+  return {
+    headers: {
+      cookie: basic.cookie,
+      "user-agent": basic.userAgent,
+      "bx-v": basic.bxV,
+      "bx-ua": basic.bxUa || "",
+      "bx-umidtoken": basic.bxUmidtoken || "",
+      "sec-ch-ua": basic.secChUa,
+      "sec-ch-ua-mobile": basic.secChUaMobile,
+      "sec-ch-ua-platform": basic.secChUaPlatform,
+      version: basic.version,
+    },
+    chatSessionId: "",
+    parentMessageId: null,
+  };
+}

package/src/services/captcha-coordinator.ts

@@ -1,161 +1,161 @@
-import type { Page } from "patchright";
-import { metrics } from "../core/metrics.ts";
-import { config } from "../core/config.ts";
-import { withAccountPage } from "./playwright.ts";
-import { qwenUrl } from "./qwen-url.ts";
-import {
-  extractBaxiaChallengeUrl,
-  logBaxiaCaptcha,
-  sanitizeCaptchaErrorDetail,
-  solveBaxiaCaptcha,
-} from "./captcha-solver.ts";
-
-const CHALLENGE_NAVIGATION_TIMEOUT_MS = 20_000;
-const CHALLENGE_PATH_MARKER = "_____tmd_____";
-
-/**
- * A challenge that could not be solved seconds ago will not be solvable on the
- * immediate retry either. Without this window every attempt of the request
- * retry loop pays the full solver budget again, which is what turned a single
- * unsolved challenge into minutes of dead time.
- */
-const FAILED_RECOVERY_BACKOFF_MS = 30_000;
-const lastFailedRecoveryAt = new Map<string, number>();
-
-async function gotoBestEffort(page: Page, url: string): Promise<void> {
-  // A WAF-blocked navigation can time out while still having rendered the
-  // challenge, so a failure here must not abort the solve attempt.
-  await page
-    .goto(url, {
-      waitUntil: "domcontentloaded",
-      timeout: Math.min(
-        config.timeouts.navigation,
-        CHALLENGE_NAVIGATION_TIMEOUT_MS,
-      ),
-    })
-    .catch(() => undefined);
-}
-
-/**
- * Make the challenge visible in the account page and solve it.
- *
- * Exported so the recovery sequence can be exercised without a live browser.
- */
-export async function solveChallengeOnPage(
-  page: Page,
-  challengeUrl: string | null,
-  waitForMs = config.captcha.timeoutMs,
-): Promise<boolean> {
-  const solverOptions = {
-    maxAttempts: config.captcha.maxAttempts,
-    retryDelayMs: config.captcha.retryDelayMs,
-    settleMs: config.captcha.settleMs,
-  };
-
-  // Qwen's own Baxia SDK sometimes renders the dialog for the background
-  // fetch. When it did, solve it in place: navigating away would discard the
-  // challenge the SDK is waiting on.
-  if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
-    return true;
-  }
-
-  logBaxiaCaptcha(
-    "challenge_opened",
-    { source: challengeUrl ? "response_body" : "chat_reload" },
-    true,
-  );
-  await gotoBestEffort(page, challengeUrl ?? qwenUrl("/"));
-
-  try {
-    return await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs });
-  } finally {
-    // Never leave the account page parked on the punish document: a stale
-    // challenge page makes the next detection pass find itself.
-    if (page.url().includes(CHALLENGE_PATH_MARKER)) {
-      await gotoBestEffort(page, qwenUrl("/"));
-    }
-  }
-}
-
-/**
- * Run the configured first-party challenge adapter without rotating accounts.
- * The account page mutex prevents a challenge solve from racing login, header
- * capture, settings sync, or another page mutation.
- *
- * `challengeBody` is the upstream response that was identified as a challenge.
- * The completion request runs as a background fetch, so the WAF answers it with
- * a punish document that is never rendered; opening that document in the page
- * is what gives the solver a slider to drive.
- */
-export async function recoverBaxiaCaptcha(
-  accountId: string | undefined,
-  label: string,
-  options: { challengeBody?: string } = {},
-): Promise<boolean> {
-  if (!config.captcha.enabled || !accountId) return false;
-
-  const solver = "baxia";
-  const startedAt = Date.now();
-
-  const lastFailure = lastFailedRecoveryAt.get(accountId) ?? 0;
-  if (startedAt - lastFailure < FAILED_RECOVERY_BACKOFF_MS) {
-    logBaxiaCaptcha("recovery_skipped", { target: label }, true);
-    return false;
-  }
-
-  metrics.increment("captcha.challenges.detected", 1, { solver });
-
-  const challengeUrl = options.challengeBody
-    ? extractBaxiaChallengeUrl(options.challengeBody, config.qwen.baseUrl)
-    : null;
-
-  // The slider itself waits up to 5s for each attempt. Keep the page
-  // operation alive for the full bounded solver budget so a slow challenge
-  // cannot be mistaken for a stuck browser and reset the account context.
-  // Two navigations (open the challenge, return to the chat page) are part of
-  // the recovery, so their budget belongs in the same total.
-  const solverOperationTimeoutMs = Math.max(
-    config.timeouts.page,
-    config.captcha.timeoutMs +
-      config.captcha.maxAttempts *
-        (5_000 + config.captcha.retryDelayMs + config.captcha.settleMs) +
-      2 * CHALLENGE_NAVIGATION_TIMEOUT_MS +
-      5_000,
-  );
-
-  try {
-    const solved = await withAccountPage(
-      accountId,
-      (page) => solveChallengeOnPage(page, challengeUrl),
-      solverOperationTimeoutMs,
-      Math.min(config.timeouts.page, 5_000),
-    );
-
-    metrics.histogram("captcha.solve.duration", Date.now() - startedAt, {
-      solver,
-    });
-
-    if (solved) {
-      lastFailedRecoveryAt.delete(accountId);
-      metrics.increment("captcha.solves.succeeded", 1, { solver });
-      logBaxiaCaptcha("recovery_succeeded", { target: label });
-      return true;
-    }
-
-    lastFailedRecoveryAt.set(accountId, Date.now());
-    metrics.increment("captcha.solves.failed", 1, { solver });
-    logBaxiaCaptcha("recovery_not_solved", { target: label });
-    return false;
-  } catch (error) {
-    lastFailedRecoveryAt.set(accountId, Date.now());
-    metrics.increment("captcha.solves.failed", 1, { solver });
-    const errorKind = error instanceof Error ? error.name : "UnknownError";
-    const detail = sanitizeCaptchaErrorDetail(error);
-    logBaxiaCaptcha("recovery_failed", {
-      target: label,
-      error: errorKind,
-      detail,
-    });
-    return false;
-  }
-}
+import type { Page } from "patchright";
+import { metrics } from "../core/metrics.ts";
+import { config } from "../core/config.ts";
+import { withAccountPage } from "./playwright.ts";
+import { qwenUrl } from "./qwen-url.ts";
+import {
+  extractBaxiaChallengeUrl,
+  logBaxiaCaptcha,
+  sanitizeCaptchaErrorDetail,
+  solveBaxiaCaptcha,
+} from "./captcha-solver.ts";
+
+const CHALLENGE_NAVIGATION_TIMEOUT_MS = 20_000;
+const CHALLENGE_PATH_MARKER = "_____tmd_____";
+
+/**
+ * A challenge that could not be solved seconds ago will not be solvable on the
+ * immediate retry either. Without this window every attempt of the request
+ * retry loop pays the full solver budget again, which is what turned a single
+ * unsolved challenge into minutes of dead time.
+ */
+const FAILED_RECOVERY_BACKOFF_MS = 30_000;
+const lastFailedRecoveryAt = new Map<string, number>();
+
+async function gotoBestEffort(page: Page, url: string): Promise<void> {
+  // A WAF-blocked navigation can time out while still having rendered the
+  // challenge, so a failure here must not abort the solve attempt.
+  await page
+    .goto(url, {
+      waitUntil: "domcontentloaded",
+      timeout: Math.min(
+        config.timeouts.navigation,
+        CHALLENGE_NAVIGATION_TIMEOUT_MS,
+      ),
+    })
+    .catch(() => undefined);
+}
+
+/**
+ * Make the challenge visible in the account page and solve it.
+ *
+ * Exported so the recovery sequence can be exercised without a live browser.
+ */
+export async function solveChallengeOnPage(
+  page: Page,
+  challengeUrl: string | null,
+  waitForMs = config.captcha.timeoutMs,
+): Promise<boolean> {
+  const solverOptions = {
+    maxAttempts: config.captcha.maxAttempts,
+    retryDelayMs: config.captcha.retryDelayMs,
+    settleMs: config.captcha.settleMs,
+  };
+
+  // Qwen's own Baxia SDK sometimes renders the dialog for the background
+  // fetch. When it did, solve it in place: navigating away would discard the
+  // challenge the SDK is waiting on.
+  if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+    return true;
+  }
+
+  logBaxiaCaptcha(
+    "challenge_opened",
+    { source: challengeUrl ? "response_body" : "chat_reload" },
+    true,
+  );
+  await gotoBestEffort(page, challengeUrl ?? qwenUrl("/"));
+
+  try {
+    return await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs });
+  } finally {
+    // Never leave the account page parked on the punish document: a stale
+    // challenge page makes the next detection pass find itself.
+    if (page.url().includes(CHALLENGE_PATH_MARKER)) {
+      await gotoBestEffort(page, qwenUrl("/"));
+    }
+  }
+}
+
+/**
+ * Run the configured first-party challenge adapter without rotating accounts.
+ * The account page mutex prevents a challenge solve from racing login, header
+ * capture, settings sync, or another page mutation.
+ *
+ * `challengeBody` is the upstream response that was identified as a challenge.
+ * The completion request runs as a background fetch, so the WAF answers it with
+ * a punish document that is never rendered; opening that document in the page
+ * is what gives the solver a slider to drive.
+ */
+export async function recoverBaxiaCaptcha(
+  accountId: string | undefined,
+  label: string,
+  options: { challengeBody?: string } = {},
+): Promise<boolean> {
+  if (!config.captcha.enabled || !accountId) return false;
+
+  const solver = "baxia";
+  const startedAt = Date.now();
+
+  const lastFailure = lastFailedRecoveryAt.get(accountId) ?? 0;
+  if (startedAt - lastFailure < FAILED_RECOVERY_BACKOFF_MS) {
+    logBaxiaCaptcha("recovery_skipped", { target: label }, true);
+    return false;
+  }
+
+  metrics.increment("captcha.challenges.detected", 1, { solver });
+
+  const challengeUrl = options.challengeBody
+    ? extractBaxiaChallengeUrl(options.challengeBody, config.qwen.baseUrl)
+    : null;
+
+  // The slider itself waits up to 5s for each attempt. Keep the page
+  // operation alive for the full bounded solver budget so a slow challenge
+  // cannot be mistaken for a stuck browser and reset the account context.
+  // Two navigations (open the challenge, return to the chat page) are part of
+  // the recovery, so their budget belongs in the same total.
+  const solverOperationTimeoutMs = Math.max(
+    config.timeouts.page,
+    config.captcha.timeoutMs +
+      config.captcha.maxAttempts *
+        (5_000 + config.captcha.retryDelayMs + config.captcha.settleMs) +
+      2 * CHALLENGE_NAVIGATION_TIMEOUT_MS +
+      5_000,
+  );
+
+  try {
+    const solved = await withAccountPage(
+      accountId,
+      (page) => solveChallengeOnPage(page, challengeUrl),
+      solverOperationTimeoutMs,
+      Math.min(config.timeouts.page, 5_000),
+    );
+
+    metrics.histogram("captcha.solve.duration", Date.now() - startedAt, {
+      solver,
+    });
+
+    if (solved) {
+      lastFailedRecoveryAt.delete(accountId);
+      metrics.increment("captcha.solves.succeeded", 1, { solver });
+      logBaxiaCaptcha("recovery_succeeded", { target: label });
+      return true;
+    }
+
+    lastFailedRecoveryAt.set(accountId, Date.now());
+    metrics.increment("captcha.solves.failed", 1, { solver });
+    logBaxiaCaptcha("recovery_not_solved", { target: label });
+    return false;
+  } catch (error) {
+    lastFailedRecoveryAt.set(accountId, Date.now());
+    metrics.increment("captcha.solves.failed", 1, { solver });
+    const errorKind = error instanceof Error ? error.name : "UnknownError";
+    const detail = sanitizeCaptchaErrorDetail(error);
+    logBaxiaCaptcha("recovery_failed", {
+      target: label,
+      error: errorKind,
+      detail,
+    });
+    return false;
+  }
+}