qwenproxy-cli 1.0.20 → 1.0.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {

package/src/core/mutex.ts

@@ -102,6 +102,16 @@ export class Mutex {
     this.lockedByKey = "";
   }
 
+  /**
+   * Heartbeat the lock: extend lockedAt while the holder is actively making progress.
+   * Prevents premature force-release during long-running streaming generations.
+   */
+  touch(key?: string): void {
+    if (this.locked && (!key || this.lockedByKey === key)) {
+      this.lockedAt = Date.now();
+    }
+  }
+
   /** Returns true if the mutex is not locked and has no waiting queue. */
   isIdle(): boolean {
     return !this.locked && this.queue.length === 0;

package/src/routes/chat/account.ts

@@ -112,10 +112,11 @@ const personalizationLocks = new Map<string, Mutex>();
 		mutex = new Mutex(
 			`chat:${chatId.substring(0, 8)}`,
 			// The chat lock is held for the whole stream lifetime. A long
-			// generation (reasoning + huge context) can legitimately exceed the
-			// global 120s hold limit; use the same budget as the acquire timeout
-			// so the force-release never kills a healthy mid-stream turn.
-			timeoutMs,
+			// generation (reasoning + huge context) can legitimately take 4-5 min;
+			// use config.timeouts.totalRequestTimeout (600s) as the max hold limit, while
+			// touchChatLock extends it on every chunk so active streams are never
+			// force-released mid-generation.
+			config.timeouts.totalRequestTimeout,
 		);
 		chatLocks.set(chatId, mutex);
 	}
@@ -141,6 +142,12 @@ const personalizationLocks = new Map<string, Mutex>();
 	};
 }
 
+export function touchChatLock(chatId: string | undefined): void {
+	if (!chatId) return;
+	const mutex = chatLocks.get(chatId);
+	mutex?.touch();
+}
+
 async function acquirePersonalizationLock(
 	accountId: string,
 ): Promise<() => void> {

package/src/routes/chat/streaming.ts

@@ -30,6 +30,7 @@ import {
   shouldRetryInvalidInputOnSameAccount,
 } from "./retry-policy.ts";
 import type { Message, OpenAIRequest, Usage } from "../../utils/types.ts";
+import { touchChatLock } from "./account.ts";
 import { StreamingToolParser } from "../../tools/parser.ts";
 import {
   getStream,
@@ -351,7 +352,7 @@ export async function processNonStreamingResponse(
     while (true) {
       const { done, value } = await reader.read();
       if (done) break;
-
+      touchChatLock(currentUiSessionId);
       const decoded = decoder.decode(value, { stream: true });
       if (!sawSseProtocol) {
         protocolBuffer += decoded;
@@ -1598,7 +1599,7 @@ export async function processStreamingResponse(
             throw readError;
           }
           if (readResult.done) break;
-
+          touchChatLock(currentUiSessionId);
           buffer += decoder.decode(readResult.value, { stream: true });
           lineEnd = buffer.indexOf("\n");
           if (lineEnd === -1) continue;
@@ -2141,7 +2142,7 @@ export async function processStreamingResponse(
           retryReadLoop: while (true) {
             const { done, value } = await retryReader.read();
             if (done) break;
-
+            touchChatLock(currentUiSessionId);
             retryBuf += retryDecoder.decode(value, { stream: true });
             let lineStart = 0;
             let lineEnd = retryBuf.indexOf("\n", lineStart);

package/src/services/captcha-coordinator.ts

@@ -111,26 +111,27 @@ export async function recoverBaxiaCaptcha(
 
   // The slider itself waits up to 5s for each attempt. Keep the page
   // operation alive for the full bounded solver budget so a slow challenge
-  // cannot be mistaken for a stuck browser and reset the account context.
+  // cannot be mistaken for a stuck browser. Do not clamp to timeouts.page.
   // Two navigations (open the challenge, return to the chat page) are part of
   // the recovery, so their budget belongs in the same total.
-  const solverOperationTimeoutMs = Math.min(
-    config.timeouts.page,
-    Math.max(
-      15_000,
-      config.captcha.timeoutMs +
-        config.captcha.maxAttempts *
-          (3_000 + config.captcha.retryDelayMs + config.captcha.settleMs) +
-        2 * CHALLENGE_NAVIGATION_TIMEOUT_MS,
-    ),
+  const solverOperationTimeoutMs = Math.max(
+    15_000,
+    config.captcha.timeoutMs +
+      config.captcha.maxAttempts *
+        (3_000 + config.captcha.retryDelayMs + config.captcha.settleMs) +
+      2 * CHALLENGE_NAVIGATION_TIMEOUT_MS,
   );
 
   try {
+    // recoverOnTimeout: false ensures that if the captcha solve times out,
+    // withAccountPage does NOT destructively kill the browser context, which
+    // previously caused "Target page, context or browser has been closed" mid-slider.
     const solved = await withAccountPage(
       accountId,
       (page) => solveChallengeOnPage(page, challengeUrl),
       solverOperationTimeoutMs,
       Math.min(config.timeouts.page, 5_000),
+      false,
     );
 
     metrics.histogram("captcha.solve.duration", Date.now() - startedAt, {

package/src/services/playwright.ts

@@ -199,7 +199,11 @@ async function recoverStuckAccountMutex(
   // A normal request can recover the browser on the next attempt. Avoid
   // recursively scheduling another reset when the reset/close path itself was
   // the operation that timed out.
-  if (!key.startsWith("profile-reset:") && !key.startsWith("close:")) {
+  if (
+    !key.startsWith("profile-reset:") &&
+    !key.startsWith("close:") &&
+    !key.startsWith("init:")
+  ) {
     schedulePlaywrightProfileReset(accountId);
   }
 }
@@ -232,7 +236,7 @@ async function acquireAccountMutex(
 const accountContexts = new Map<string, BrowserContext>();
 const accountPages = new Map<string, Page>();
 const cachedUserAgents = new Map<string, string>();
-
+const inFlightAccountInits = new Map<string, Promise<void>>();
 let sharedBrowser: Browser | null = null;
 let sharedBrowserPromise: Promise<Browser> | null = null;
 
@@ -308,8 +312,17 @@ async function hasValidAuthCookie(context: BrowserContext, timeoutMs = 3_000): P
  * Detect whether the page is authenticated.
  * Probes the authoritative /api/v1/auths/ endpoint from the page context (verified via HAR forensics)
  * and falls back to inspecting the presence of visible "Log in" / "Sign up" buttons.
+ *
+ * The probe is bounded: page.evaluate ignores Playwright's default timeouts, so a
+ * WAF-blocked page whose in-page fetch never settles would hang the caller with no
+ * error at all. A probe that cannot answer is treated as "not logged in" — the
+ * caller re-authenticates or reloads, which is strictly better than burning the
+ * whole header budget waiting on a frozen page.
  */
-export async function isPageLoggedIn(page: Page): Promise<boolean> {
+export async function isPageLoggedIn(
+  page: Page,
+  timeoutMs = SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
+): Promise<boolean> {
   if (!page) return false;
   if (typeof page.isClosed === "function" && page.isClosed()) return false;
   try {
@@ -317,7 +330,7 @@ export async function isPageLoggedIn(page: Page): Promise<boolean> {
     if (url.includes("/auth") || url.includes("/login")) return false;
     if (typeof page.evaluate !== "function") return true;
 
-    return await page
+    const probe = page
       .evaluate(async () => {
         try {
           const res = await fetch("/api/v1/auths/", { method: "GET" });
@@ -330,6 +343,12 @@ export async function isPageLoggedIn(page: Page): Promise<boolean> {
         }
       })
       .catch(() => false);
+
+    return await withTimeout(
+      probe,
+      Math.max(1_000, timeoutMs),
+      `session probe timed out after ${timeoutMs}ms`,
+    );
   } catch {
     return false;
   }
@@ -456,6 +475,16 @@ const FIRST_TRIGGER_GRACE_MS = 3_000;
  * sends cover it while still failing a page that never produces them.
  */
 const HEADER_CAPTURE_TRIGGER_ATTEMPTS = 3;
+/**
+ * A healthy Qwen chat page renders its input within a couple of seconds. When
+ * it never does, the page is blocked (WAF interstitial, punish document, or a
+ * cold SPA that failed to hydrate) and page.focus would wait out the 60s page
+ * default, freezing the whole capture. Bound the wait well under the header
+ * budget so a stuck page reloads and retries instead of hanging.
+ */
+const CHAT_INPUT_APPEAR_TIMEOUT_MS = 15_000;
+/** Per-action bound for focus/fill/type once the input is already visible. */
+const CHAT_INPUT_ACTION_TIMEOUT_MS = 10_000;
 
 /**
  * A challenge blocking the chat page makes the send button inert, so header
@@ -1269,12 +1298,19 @@ export async function initPlaywrightForAccount(
     );
     return;
   }
+  const existingInit = inFlightAccountInits.get(account.id);
+  if (existingInit) {
+    await existingInit;
+    return;
+  }
 
-  const release = await acquireAccountMutex(
-    account.id,
-    `init:${account.id.substring(0, 12)}`,
-  );
-  try {
+  const initPromise = (async () => {
+    const release = await acquireAccountMutex(
+      account.id,
+      `init:${account.id.substring(0, 12)}`,
+      Math.max(PLAYWRIGHT_MUTEX_WAIT_MS, 120_000),
+    );
+    try {
     // Double-check after acquiring lock
     if (accountPages.has(account.id)) {
       return;
@@ -1460,8 +1496,16 @@ export async function initPlaywrightForAccount(
       cleanupPlaywrightAccountState(account.id);
       throw error;
     }
+    } finally {
+      release();
+    }
+  })();
+
+  inFlightAccountInits.set(account.id, initPromise);
+  try {
+    await initPromise;
   } finally {
-    release();
+    inFlightAccountInits.delete(account.id);
   }
 }
 
@@ -1992,6 +2036,7 @@ export async function captureQwenHeaders(
       let headersCaptured = false;
       let retriggerRequested = false;
       let lastAttemptGraceTimedOut = false;
+      let lastAttemptInputMissing = false;
       let graceTimeoutCount = 0;
       let wakeTriggerLoop: (() => void) | undefined;
       const deadline = Date.now() + timeoutMs;
@@ -2199,7 +2244,10 @@ export async function captureQwenHeaders(
       // burn every trigger attempt on a textarea that does not exist. Re-login
       // immediately when credentials are available; otherwise fail fast with a
       // clear diagnosis instead of 3 pointless grace timeouts.
-      const loggedIn = await isPageLoggedIn(page);
+      const loggedIn = await isPageLoggedIn(
+        page,
+        Math.max(1_000, Math.min(remainingBudgetMs(), SESSION_PROBE_NAVIGATION_TIMEOUT_MS)),
+      );
       if (!loggedIn) {
         const { getAccountCredentials } = await import("../core/accounts.ts");
         const creds = getAccountCredentials(accountId);
@@ -2237,11 +2285,59 @@ export async function captureQwenHeaders(
       // Mirrors upstream 5b3fd3e (robust account header capture).
       const inputSelector =
         'textarea.message-input-textarea:visible, textarea:visible, [contenteditable="true"]:visible';
-      await page.focus(inputSelector);
-      if (settled || page.isClosed()) return;
-      await page.fill(inputSelector, "");
+      // Bound the appearance wait: a page that never renders the chat input is
+      // blocked (WAF interstitial, punish document, or failed SPA hydration).
+      // Unbounded, page.focus would burn its 60s default timeout on every
+      // attempt, freezing the whole capture and cooling a healthy account with
+      // AuthInitFailed. A miss marks the attempt for a reload instead.
+      try {
+        await page
+          .locator(inputSelector)
+          .first()
+          .waitFor({
+            state: "visible",
+            timeout: Math.max(
+              1,
+              Math.min(CHAT_INPUT_APPEAR_TIMEOUT_MS, remainingBudgetMs()),
+            ),
+          });
+      } catch {
+        if (settled || page.isClosed()) return;
+        console.warn(
+          `⏱️  [Playwright] Chat input never appeared for ${accountId} (attempt ${attempt}); reloading`,
+        );
+        lastAttemptInputMissing = true;
+        retriggerRequested = true;
+        wakeTrigger();
+        return;
+      }
       if (settled || page.isClosed()) return;
-      await page.type(inputSelector, "a", { delay: 100 });
+      const inputActionTimeoutMs = Math.max(
+        1,
+        Math.min(CHAT_INPUT_ACTION_TIMEOUT_MS, remainingBudgetMs()),
+      );
+      try {
+        await page.focus(inputSelector, { timeout: inputActionTimeoutMs });
+        if (settled || page.isClosed()) return;
+        await page.fill(inputSelector, "", { timeout: inputActionTimeoutMs });
+        if (settled || page.isClosed()) return;
+        await page.type(inputSelector, "a", {
+          delay: 100,
+          timeout: inputActionTimeoutMs,
+        });
+      } catch {
+        // The input detached mid-interaction (challenge overlay, SPA
+        // re-render): same diagnosis as never appearing — only a fresh load
+        // recovers it.
+        if (settled || page.isClosed()) return;
+        console.warn(
+          `⏱️  [Playwright] Chat input interaction failed for ${accountId} (attempt ${attempt}); reloading`,
+        );
+        lastAttemptInputMissing = true;
+        retriggerRequested = true;
+        wakeTrigger();
+        return;
+      }
       if (settled || page.isClosed()) return;
       await sleep(2000);
       if (settled || page.isClosed()) return;
@@ -2309,8 +2405,16 @@ export async function captureQwenHeaders(
           // no request (indicating a stuck page/challenge that needs a fresh load).
           // Attempt 2 preserves the page from attempt 1 so the bx SDK that just
           // finished initializing in the background is not thrown away.
-          if (attempt === 1 || (lastAttemptGraceTimedOut && attempt >= 3)) {
+          // A missing chat input is the exception: the page never rendered the
+          // chat UI, so there is no warm SDK state to protect and only a fresh
+          // load can recover it.
+          if (
+            attempt === 1 ||
+            lastAttemptInputMissing ||
+            (lastAttemptGraceTimedOut && attempt >= 3)
+          ) {
             lastAttemptGraceTimedOut = false;
+            lastAttemptInputMissing = false;
             await openChatPage();
           }
           if (settled) return;

package/src/services/qwen.ts

@@ -733,14 +733,15 @@ async function withQwenBrowserPage<T>(
   operationTimeoutMs = config.timeouts.page,
   recoverOnTimeout = true,
 ): Promise<T> {
-  // Keep the account page on the chat UI for normal browser operations. The
-  // personalization helper passes /settings/personalization explicitly; an
-  // omitted target must not leave a same-origin settings page in place.
-  const effectiveTargetPath = targetPath || "/";
-  const targetUrl = qwenUrl(effectiveTargetPath);
+  // When targetPath is omitted, any page under the Qwen origin can run the
+  // in-page evaluate/fetch without an expensive, stream-breaking page.goto.
+  // Only navigate when targetPath is explicitly provided or when the page is not
+  // on the Qwen origin yet (e.g. about:blank).
+  const targetUrl = qwenUrl(targetPath || "/");
   const targetOrigin = new URL(targetUrl).origin;
-  const normalizedTargetPath =
-    new URL(targetUrl).pathname.replace(/\/+$/, "") || "/";
+  const normalizedTargetPath = targetPath
+    ? new URL(targetUrl).pathname.replace(/\/+$/, "") || "/"
+    : null;
 
   return withAccountPage(
     accountId,
@@ -755,10 +756,11 @@ async function withQwenBrowserPage<T>(
         // Navigate below when the current page has no usable URL.
       }
 
-      if (
+      const needsNavigation =
         currentOrigin !== targetOrigin ||
-        (normalizedTargetPath && currentPath !== normalizedTargetPath)
-      ) {
+        (normalizedTargetPath !== null && currentPath !== normalizedTargetPath);
+
+      if (needsNavigation) {
         await page.goto(targetUrl, {
           waitUntil: "domcontentloaded",
           timeout: Math.min(config.timeouts.navigation, operationTimeoutMs),
@@ -773,44 +775,7 @@ async function withQwenBrowserPage<T>(
   );
 }
 
-async function withQwenPersonalizationPage<T>(
-  accountId: string,
-  fn: (page: Page) => Promise<T>,
-  operationTimeoutMs = config.timeouts.page,
-  recoverOnTimeout = true,
-): Promise<T> {
-  return withQwenBrowserPage(
-    accountId,
-    async (page) => {
-      try {
-        return await fn(page);
-      } finally {
-        if (!page.isClosed()) {
-          try {
-            const currentUrl = new URL(page.url());
-            const currentPath = currentUrl.pathname.replace(/\/+$/, "") || "/";
-            if (currentUrl.origin !== qwenOrigin() || currentPath !== "/") {
-              await page.goto(qwenUrl("/"), {
-                waitUntil: "domcontentloaded",
-                timeout: Math.min(config.timeouts.navigation, operationTimeoutMs),
-              });
-            }
-          } catch (error) {
-            // Do not mask the personalization request result if restoring the
-            // normal chat page fails; the next normal operation will retry it.
-            logger.warn("[Qwen] Could not restore chat page after personalization", {
-              accountId,
-              error: error instanceof Error ? error.message : String(error),
-            });
-          }
-        }
-      }
-    },
-    "/settings/personalization",
-    operationTimeoutMs,
-    recoverOnTimeout,
-  );
-}
+
 
 /**
  * Build minimal headers for browser-side fetch. The browser automatically

package/src/tools/parser.ts

@@ -302,6 +302,14 @@ function advanceMarkdownCodeState(
   let delimiterLength = initialDelimiterLength;
 
   for (let i = 0; i < text.length;) {
+    // Inline code spans (1 or 2 backticks) cannot cross line breaks per CommonMark §6.1.
+    // Only fenced code blocks (3+ backticks) span multiple lines.
+    if (text[i] === "\n" && delimiterLength < 3) {
+      delimiterLength = 0;
+      i++;
+      continue;
+    }
+
     if (text[i] !== "`") {
       i++;
       continue;
@@ -320,7 +328,6 @@ function advanceMarkdownCodeState(
 
     i += runLength;
   }
-
   return delimiterLength;
 }
 
@@ -331,6 +338,13 @@ function findNextToolOpenTagOutsideMarkdownCode(
   let delimiterLength = initialDelimiterLength;
 
   for (let i = 0; i < buffer.length;) {
+    // Inline code spans (1 or 2 backticks) cannot cross line breaks per CommonMark §6.1.
+    if (buffer[i] === "\n" && delimiterLength < 3) {
+      delimiterLength = 0;
+      i++;
+      continue;
+    }
+
     if (buffer[i] === "`") {
       let runLength = 1;
       while (i + runLength < buffer.length && buffer[i + runLength] === "`") {
@@ -346,7 +360,6 @@ function findNextToolOpenTagOutsideMarkdownCode(
       i += runLength;
       continue;
     }
-
     if (delimiterLength === 0 && buffer[i] === "<") {
       const sub = buffer.substring(i);
       for (const name of getOpenNames()) {
@@ -371,6 +384,13 @@ function findPartialToolOpenIndexOutsideMarkdownCode(
   const openNames = getOpenNames();
 
   for (let i = 0; i < buffer.length;) {
+    // Inline code spans (1 or 2 backticks) cannot cross line breaks per CommonMark §6.1.
+    if (buffer[i] === "\n" && delimiterLength < 3) {
+      delimiterLength = 0;
+      i++;
+      continue;
+    }
+
     if (buffer[i] === "`") {
       let runLength = 1;
       while (i + runLength < buffer.length && buffer[i + runLength] === "`") {
@@ -386,7 +406,6 @@ function findPartialToolOpenIndexOutsideMarkdownCode(
       i += runLength;
       continue;
     }
-
     if (delimiterLength === 0 && buffer[i] === "<") {
       const tailLower = buffer.substring(i).toLowerCase();
       if (!tailLower.includes(">")) {