qwenproxy-cli 1.0.0

package/src/routes/videos.ts

@@ -0,0 +1,214 @@
+import type { Context } from "hono";
+import {
+  generateVideo,
+  isSupportedMediaSize,
+  MEDIA_SIZE_OPTIONS,
+  pollVideoTask,
+  supportsPromptMediaGeneration,
+} from "../services/media-generation.ts";
+import { logger } from "../core/logger.ts";
+import { sendOpenAIError } from "../api/error-helpers.ts";
+import { NotFoundError, ValidationError } from "../core/errors.ts";
+
+const DEFAULT_SIZE = "16:9";
+
+const TASK_TTL_MS = 60 * 60_000;
+
+type MediaTaskStatus = "pending" | "running" | "completed" | "failed";
+
+interface VideoTaskEntry {
+  accountId: string;
+  chatId: string;
+  createdAt: number;
+  status: MediaTaskStatus;
+  videoUrl?: string;
+}
+
+interface VideosGenerationsRequest {
+  model?: unknown;
+  prompt?: unknown;
+  size?: unknown;
+  wait?: unknown;
+}
+
+const videoTasks = new Map<string, VideoTaskEntry>();
+
+function cleanupExpiredTasks(): void {
+  const cutoff = Date.now() - TASK_TTL_MS;
+  for (const [taskId, entry] of videoTasks) {
+    if (entry.createdAt < cutoff) {
+      videoTasks.delete(taskId);
+    }
+  }
+}
+
+function validationError(message: string, param: string): ValidationError {
+  const err = new ValidationError(message);
+  err.param = param;
+  return err;
+}
+
+export async function videosGenerations(c: Context): Promise<Response> {
+  cleanupExpiredTasks();
+
+  let body: VideosGenerationsRequest;
+  try {
+    body = await c.req.json();
+  } catch {
+    return sendOpenAIError(c, new ValidationError("Request body must be valid JSON"));
+  }
+
+  const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
+  if (!prompt) {
+    return sendOpenAIError(
+      c,
+      validationError("`prompt` must be a non-empty string", "prompt"),
+    );
+  }
+
+  const size = body.size === undefined ? DEFAULT_SIZE : body.size;
+  if (!isSupportedMediaSize(size)) {
+    return sendOpenAIError(
+      c,
+      validationError(
+        `\`size\` must be one of: ${MEDIA_SIZE_OPTIONS.join(", ")}`,
+        "size",
+      ),
+    );
+  }
+
+  const model =
+    typeof body.model === "string" && body.model.trim()
+      ? body.model.trim()
+      : "";
+  if (!model) {
+    return sendOpenAIError(
+      c,
+      validationError("`model` must be the model selected by the client", "model"),
+    );
+  }
+  if (!supportsPromptMediaGeneration(model, "video")) {
+    return sendOpenAIError(
+      c,
+      validationError(
+        `Model \`${model}\` requires a reference image and is not available through prompt-only video generation yet`,
+        "model",
+      ),
+    );
+  }
+  const wait = body.wait !== false;
+
+  logger.info("Video generation request", {
+    model,
+    size,
+    wait,
+  });
+
+  try {
+    const result = await generateVideo({
+      model,
+      prompt,
+      size,
+      waitForCompletion: wait,
+    });
+
+    const created = Math.floor(Date.now() / 1000);
+
+    // The upstream can return the video URL inline, without a task id.
+    if (!result.task_id) {
+      if (result.status === "completed" && result.video_url) {
+        return c.json({
+          created,
+          task_id: "",
+          status: "completed",
+          data: [{ url: result.video_url }],
+        });
+      }
+      return sendOpenAIError(
+        c,
+        new Error("Video generation returned no task or video URL"),
+        500,
+      );
+    }
+
+    videoTasks.set(result.task_id, {
+      accountId: result.accountId,
+      chatId: result.chatId,
+      createdAt: Date.now(),
+      status: result.status,
+      videoUrl: result.video_url,
+    });
+
+    if (result.status === "failed") {
+      logger.error("Video generation task failed", { taskId: result.task_id });
+      return sendOpenAIError(c, new Error("Video generation failed"), 500);
+    }
+
+    if (result.status === "completed") {
+      return c.json({
+        created,
+        task_id: result.task_id,
+        status: "completed",
+        data: [{ url: result.video_url }],
+      });
+    }
+
+    // wait=false, or the upstream poll window elapsed before completion.
+    return c.json({
+      created,
+      task_id: result.task_id,
+      status: result.status,
+    });
+  } catch (error) {
+    logger.error("Video generation failed", {
+      model,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return sendOpenAIError(c, error, 500);
+  }
+}
+
+export async function videoTaskStatus(c: Context): Promise<Response> {
+  cleanupExpiredTasks();
+
+  const taskId = c.req.param("taskId");
+  if (!taskId) {
+    return sendOpenAIError(c, new NotFoundError("Video task not found"));
+  }
+
+  const entry = videoTasks.get(taskId);
+  if (!entry) {
+    return sendOpenAIError(c, new NotFoundError(`Video task not found: ${taskId}`));
+  }
+
+  const wait = c.req.query("wait") === "true";
+
+  try {
+    const isTerminal = entry.status === "completed" || entry.status === "failed";
+    if (wait && !isTerminal) {
+      // pollVideoTask blocks until a terminal status or its internal timeout.
+      const result = await pollVideoTask({ taskId, accountId: entry.accountId });
+      entry.status = result.status;
+      entry.videoUrl = result.video_url ?? entry.videoUrl;
+      if (result.status === "failed") {
+        logger.error("Video task failed", {
+          taskId,
+          error: result.error ?? "unknown",
+        });
+      }
+    }
+
+    return c.json({
+      task_id: taskId,
+      status: entry.status,
+      video_url: entry.videoUrl ?? null,
+      created: Math.floor(entry.createdAt / 1000),
+    });
+  } catch (error) {
+    logger.error("Video task status check failed", {
+      taskId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return sendOpenAIError(c, error, 500);
+  }
+}

package/src/services/auth-playwright.ts

@@ -0,0 +1,173 @@
+import { AuthError } from "../core/errors.ts";
+import { getAccountCredentials, loadAccounts } from "../core/accounts.ts";
+import { config } from "../core/config.ts";
+import {
+  getBasicHeaders as getPlaywrightBasicHeaders,
+  initPlaywrightForAccount,
+  isPlaywrightInitialized,
+  refreshHeaders,
+} from "./playwright.ts";
+
+export interface HeaderResult {
+  headers: Record<string, string>;
+  chatSessionId: string;
+  parentMessageId: string | null;
+}
+
+export function isAuthMockEnabled(): boolean {
+  return (
+    process.env.TEST_MOCK_QWEN_AUTH === "true" &&
+    process.env.NODE_ENV !== "production"
+  );
+}
+
+function isRunningUnderNodeTest(): boolean {
+  return process.argv.some(
+    (arg) =>
+      arg === "--test" ||
+      arg.includes("src/tests/") ||
+      arg.includes("src\\tests\\"),
+  );
+}
+
+async function ensurePlaywrightInitialized(accountId: string): Promise<void> {
+  if (isPlaywrightInitialized(accountId)) return;
+
+  if (isRunningUnderNodeTest()) {
+    throw new Error(`Playwright not initialized for account: ${accountId}`);
+  }
+
+  const credentials = getAccountCredentials(accountId);
+  if (!credentials) {
+    throw new AuthError(`Qwen account ${accountId} is not configured.`);
+  }
+
+  await initPlaywrightForAccount(
+    credentials,
+    config.playwright.headless,
+    config.playwright.browser,
+  );
+
+  // Standby accounts are initialized lazily. Apply the same account-level
+  // settings that startup preparation would apply.
+  try {
+    const { disableNativeTools } = await import("./qwen.ts");
+    await disableNativeTools(accountId).catch(() => {});
+  } catch {
+    // Non-fatal: chat creation will still work with default account settings.
+  }
+}
+
+export async function getBasicHeaders(accountId?: string): Promise<{
+  cookie: string;
+  userAgent: string;
+  bxV: string;
+  bxUa: string;
+  bxUmidtoken: string;
+  secChUa: string;
+  secChUaMobile: string;
+  secChUaPlatform: string;
+  version: string;
+}> {
+  if (isAuthMockEnabled()) {
+    return {
+      cookie: "token=mock",
+      userAgent: "mock",
+      bxV: "2.5.37",
+      bxUa: "mock-bx-ua",
+      bxUmidtoken: "mock-bx-umidtoken",
+      secChUa: "",
+      secChUaMobile: "?0",
+      secChUaPlatform: "",
+      version: "0.2.89",
+    };
+  }
+
+  const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
+  if (!resolvedAccountId) {
+    throw new AuthError(
+      "No Qwen accounts configured. Add accounts with npm run login.",
+    );
+  }
+
+  await ensurePlaywrightInitialized(resolvedAccountId);
+  return getPlaywrightBasicHeaders(resolvedAccountId);
+}
+
+export function isTokenExpiringSoon(
+  cookie: string,
+  minutesBeforeExpiry = 5,
+): boolean {
+  const tokenMatch = cookie.match(/token=([^;]+)/);
+  if (!tokenMatch) return false;
+
+  try {
+    const token = decodeURIComponent(tokenMatch[1]);
+    const segments = token.split(".");
+    // Some Qwen deployments use opaque cookies. Treating those as expired
+    // forces expensive header capture on every personalization request.
+    if (segments.length !== 3 || !segments[1]) return false;
+
+    const payloadJson = Buffer.from(segments[1], "base64url").toString("utf-8");
+    const payload = JSON.parse(payloadJson);
+    const exp = payload.exp;
+    if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+
+    const nowSec = Math.floor(Date.now() / 1000);
+    const thresholdSec = minutesBeforeExpiry * 60;
+    return exp - nowSec < thresholdSec;
+  } catch {
+    return false;
+  }
+}
+
+export async function getQwenHeaders(
+  forceNew = false,
+  accountId?: string,
+): Promise<HeaderResult> {
+  if (isAuthMockEnabled()) {
+    const basic = await getBasicHeaders(accountId);
+    return {
+      headers: {
+        cookie: basic.cookie,
+        "user-agent": basic.userAgent,
+        "bx-v": basic.bxV,
+        "bx-ua": basic.bxUa,
+        "bx-umidtoken": basic.bxUmidtoken,
+        version: basic.version,
+      },
+      chatSessionId: "",
+      parentMessageId: null,
+    };
+  }
+
+  const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
+  if (!resolvedAccountId) {
+    throw new AuthError(
+      "No Qwen accounts configured. Add accounts with npm run login.",
+    );
+  }
+
+  await ensurePlaywrightInitialized(resolvedAccountId);
+
+  if (forceNew) {
+    await refreshHeaders(resolvedAccountId);
+  }
+
+  const basic = await getPlaywrightBasicHeaders(resolvedAccountId);
+  return {
+    headers: {
+      cookie: basic.cookie,
+      "user-agent": basic.userAgent,
+      "bx-v": basic.bxV,
+      "bx-ua": basic.bxUa || "",
+      "bx-umidtoken": basic.bxUmidtoken || "",
+      "sec-ch-ua": basic.secChUa,
+      "sec-ch-ua-mobile": basic.secChUaMobile,
+      "sec-ch-ua-platform": basic.secChUaPlatform,
+      version: basic.version,
+    },
+    chatSessionId: "",
+    parentMessageId: null,
+  };
+}

package/src/services/captcha-coordinator.ts

@@ -0,0 +1,161 @@
+import type { Page } from "patchright";
+import { metrics } from "../core/metrics.ts";
+import { config } from "../core/config.ts";
+import { withAccountPage } from "./playwright.ts";
+import { qwenUrl } from "./qwen-url.ts";
+import {
+  extractBaxiaChallengeUrl,
+  logBaxiaCaptcha,
+  sanitizeCaptchaErrorDetail,
+  solveBaxiaCaptcha,
+} from "./captcha-solver.ts";
+
+const CHALLENGE_NAVIGATION_TIMEOUT_MS = 20_000;
+const CHALLENGE_PATH_MARKER = "_____tmd_____";
+
+/**
+ * A challenge that could not be solved seconds ago will not be solvable on the
+ * immediate retry either. Without this window every attempt of the request
+ * retry loop pays the full solver budget again, which is what turned a single
+ * unsolved challenge into minutes of dead time.
+ */
+const FAILED_RECOVERY_BACKOFF_MS = 30_000;
+const lastFailedRecoveryAt = new Map<string, number>();
+
+async function gotoBestEffort(page: Page, url: string): Promise<void> {
+  // A WAF-blocked navigation can time out while still having rendered the
+  // challenge, so a failure here must not abort the solve attempt.
+  await page
+    .goto(url, {
+      waitUntil: "domcontentloaded",
+      timeout: Math.min(
+        config.timeouts.navigation,
+        CHALLENGE_NAVIGATION_TIMEOUT_MS,
+      ),
+    })
+    .catch(() => undefined);
+}
+
+/**
+ * Make the challenge visible in the account page and solve it.
+ *
+ * Exported so the recovery sequence can be exercised without a live browser.
+ */
+export async function solveChallengeOnPage(
+  page: Page,
+  challengeUrl: string | null,
+  waitForMs = config.captcha.timeoutMs,
+): Promise<boolean> {
+  const solverOptions = {
+    maxAttempts: config.captcha.maxAttempts,
+    retryDelayMs: config.captcha.retryDelayMs,
+    settleMs: config.captcha.settleMs,
+  };
+
+  // Qwen's own Baxia SDK sometimes renders the dialog for the background
+  // fetch. When it did, solve it in place: navigating away would discard the
+  // challenge the SDK is waiting on.
+  if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+    return true;
+  }
+
+  logBaxiaCaptcha(
+    "challenge_opened",
+    { source: challengeUrl ? "response_body" : "chat_reload" },
+    true,
+  );
+  await gotoBestEffort(page, challengeUrl ?? qwenUrl("/"));
+
+  try {
+    return await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs });
+  } finally {
+    // Never leave the account page parked on the punish document: a stale
+    // challenge page makes the next detection pass find itself.
+    if (page.url().includes(CHALLENGE_PATH_MARKER)) {
+      await gotoBestEffort(page, qwenUrl("/"));
+    }
+  }
+}
+
+/**
+ * Run the configured first-party challenge adapter without rotating accounts.
+ * The account page mutex prevents a challenge solve from racing login, header
+ * capture, settings sync, or another page mutation.
+ *
+ * `challengeBody` is the upstream response that was identified as a challenge.
+ * The completion request runs as a background fetch, so the WAF answers it with
+ * a punish document that is never rendered; opening that document in the page
+ * is what gives the solver a slider to drive.
+ */
+export async function recoverBaxiaCaptcha(
+  accountId: string | undefined,
+  label: string,
+  options: { challengeBody?: string } = {},
+): Promise<boolean> {
+  if (!config.captcha.enabled || !accountId) return false;
+
+  const solver = "baxia";
+  const startedAt = Date.now();
+
+  const lastFailure = lastFailedRecoveryAt.get(accountId) ?? 0;
+  if (startedAt - lastFailure < FAILED_RECOVERY_BACKOFF_MS) {
+    logBaxiaCaptcha("recovery_skipped", { target: label }, true);
+    return false;
+  }
+
+  metrics.increment("captcha.challenges.detected", 1, { solver });
+
+  const challengeUrl = options.challengeBody
+    ? extractBaxiaChallengeUrl(options.challengeBody, config.qwen.baseUrl)
+    : null;
+
+  // The slider itself waits up to 5s for each attempt. Keep the page
+  // operation alive for the full bounded solver budget so a slow challenge
+  // cannot be mistaken for a stuck browser and reset the account context.
+  // Two navigations (open the challenge, return to the chat page) are part of
+  // the recovery, so their budget belongs in the same total.
+  const solverOperationTimeoutMs = Math.max(
+    config.timeouts.page,
+    config.captcha.timeoutMs +
+      config.captcha.maxAttempts *
+        (5_000 + config.captcha.retryDelayMs + config.captcha.settleMs) +
+      2 * CHALLENGE_NAVIGATION_TIMEOUT_MS +
+      5_000,
+  );
+
+  try {
+    const solved = await withAccountPage(
+      accountId,
+      (page) => solveChallengeOnPage(page, challengeUrl),
+      solverOperationTimeoutMs,
+      Math.min(config.timeouts.page, 5_000),
+    );
+
+    metrics.histogram("captcha.solve.duration", Date.now() - startedAt, {
+      solver,
+    });
+
+    if (solved) {
+      lastFailedRecoveryAt.delete(accountId);
+      metrics.increment("captcha.solves.succeeded", 1, { solver });
+      logBaxiaCaptcha("recovery_succeeded", { target: label });
+      return true;
+    }
+
+    lastFailedRecoveryAt.set(accountId, Date.now());
+    metrics.increment("captcha.solves.failed", 1, { solver });
+    logBaxiaCaptcha("recovery_not_solved", { target: label });
+    return false;
+  } catch (error) {
+    lastFailedRecoveryAt.set(accountId, Date.now());
+    metrics.increment("captcha.solves.failed", 1, { solver });
+    const errorKind = error instanceof Error ? error.name : "UnknownError";
+    const detail = sanitizeCaptchaErrorDetail(error);
+    logBaxiaCaptcha("recovery_failed", {
+      target: label,
+      error: errorKind,
+      detail,
+    });
+    return false;
+  }
+}