qwenproxy-cli 1.2.10 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.2.10",
+  "version": "1.3.1",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {
@@ -26,8 +26,8 @@
     "reset": "npx tsx src/reset-cooldowns.ts",
     "purge": "npx tsx src/delete-chats.ts",
     "test": "npm run test:mock && npm run test:live",
-    "test:mock": "tsx --test --test-concurrency=1 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts",
-    "test:mock:fast": "tsx --test --test-concurrency=2 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts",
+    "test:mock": "tsx --test --test-concurrency=1 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts src/tests/auth-jwt-and-validation.test.ts src/tests/tui-port-and-key-modal.test.ts",
+    "test:mock:fast": "tsx --test --test-concurrency=2 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts src/tests/auth-jwt-and-validation.test.ts src/tests/tui-port-and-key-modal.test.ts",
     "test:live": "tsx --test src/tests/concurrentChat.test.ts src/tests/agenticStress.test.ts",
     "benchmark:proxy": "npx tsx src/benchmarks/proxy-baseline.ts",
     "typecheck": "tsc --noEmit"

package/src/api/server.ts

@@ -172,7 +172,13 @@ app.use("*", async (c, next) => {
     c.req.path === "/logs" ||
     c.req.path.startsWith("/logs") ||
     c.req.path.startsWith("/diagnostics") ||
-    c.req.path === "/favicon.ico";
+    c.req.path === "/favicon.ico" ||
+    c.req.path === "/v1/models" ||
+    c.req.path.startsWith("/v1/models/") ||
+    c.req.path === "/models" ||
+    c.req.path.startsWith("/models/") ||
+    c.req.path === "/v1/chat/mode" ||
+    c.req.path === "/chat/mode";
 
   if (!isProbe) {
     metrics.increment("requests.total");
@@ -445,7 +451,13 @@ app.onError((err, c) => {
     c.req.path === "/health" ||
     c.req.path === "/metrics" ||
     c.req.path.startsWith("/diagnostics") ||
-    c.req.path === "/favicon.ico";
+    c.req.path === "/favicon.ico" ||
+    c.req.path === "/v1/models" ||
+    c.req.path.startsWith("/v1/models/") ||
+    c.req.path === "/models" ||
+    c.req.path.startsWith("/models/") ||
+    c.req.path === "/v1/chat/mode" ||
+    c.req.path === "/chat/mode";
   if (!isProbe) {
     metrics.increment("requests.errors");
   }

package/src/core/accounts.ts

@@ -4,7 +4,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { getDatabase } from "./database.ts";
 import { decrypt, encrypt } from "./crypto-utils.ts";
-import { getAccountProfilePath, getProfilesDir } from "./paths.ts";
+import { getAccountProfilePath, getProfilesDir, isRunningUnderNodeTest } from "./paths.ts";
+import { updateEnvVariable } from "./local-auth.ts";
 
 export interface QwenAccount {
   id: string;
@@ -14,6 +15,29 @@ export interface QwenAccount {
   cooldown_reason?: string | null;
 }
 
+export function isPlaceholderAccountEmail(email: string, password?: string): boolean {
+  if (!email || typeof email !== "string") return false;
+  const clean = email.trim().toLowerCase();
+  if (
+    clean === "email1@example.com" ||
+    clean === "email2@example.com" ||
+    clean === "user@example.com" ||
+    clean === "test@example.com" ||
+    clean === "your-email@example.com" ||
+    clean.startsWith("email1@") ||
+    clean.startsWith("email2@")
+  ) {
+    return true;
+  }
+  if (
+    password &&
+    (password === "password1" || password === "password2" || password === "changeme")
+  ) {
+    return true;
+  }
+  return false;
+}
+
 function generateId(email: string): string {
   return crypto
     .createHash("md5")
@@ -59,10 +83,12 @@ function parseEnvAccounts(): QwenAccount[] {
       }
       const email = clean(trimmed.substring(0, colonIdx));
       const password = clean(trimmed.substring(colonIdx + 1));
-      if (!email || !password) {
-        console.warn(
-          `[Accounts] Invalid QWEN_ACCOUNTS entry at index ${index}: "${trimmed}"`,
-        );
+      if (!email || !password || isPlaceholderAccountEmail(email, password)) {
+        if (!email || !password) {
+          console.warn(
+            `[Accounts] Invalid QWEN_ACCOUNTS entry at index ${index}: "${trimmed}"`,
+          );
+        }
         return null;
       }
       return {
@@ -79,6 +105,17 @@ let lastSyncTime = 0;
 const SYNC_INTERVAL = 30_000;
 
 function syncEnvAccounts(): void {
+  const db = getDatabase();
+  // Automatically purge any dummy placeholder accounts that may have been seeded from .env.example
+  try {
+    db.prepare(`
+      DELETE FROM accounts
+      WHERE lower(email) IN ('email1@example.com', 'email2@example.com', 'user@example.com', 'test@example.com', 'your-email@example.com')
+         OR lower(email) LIKE 'email1@%'
+         OR lower(email) LIKE 'email2@%'
+    `).run();
+  } catch {}
+
   const envAccounts = process.env.QWEN_ACCOUNTS || "";
   const now = Date.now();
   if (envAccounts === lastSyncedEnv && now - lastSyncTime < SYNC_INTERVAL)
@@ -90,7 +127,6 @@ function syncEnvAccounts(): void {
   const accounts = parseEnvAccounts();
   if (accounts.length === 0) return;
 
-  const db = getDatabase();
   const upsert = db.prepare(`
     INSERT INTO accounts (id, email, password) VALUES (?, ?, ?)
     ON CONFLICT(email) DO UPDATE SET password = excluded.password, updated_at = datetime('now')
@@ -124,15 +160,17 @@ function getCachedAccounts(): QwenAccount[] {
     )
     .all() as QwenAccount[];
 
-  accountsCache = rows.map((row) => {
-    let password = "";
-    try {
-      password = decrypt(row.password);
-    } catch {
-      password = "";
-    }
-    return { ...row, password };
-  });
+  accountsCache = rows
+    .filter((row) => !isPlaceholderAccountEmail(row.email))
+    .map((row) => {
+      let password = "";
+      try {
+        password = decrypt(row.password);
+      } catch {
+        password = "";
+      }
+      return { ...row, password };
+    });
   accountsCacheTime = now;
   return accountsCache;
 }
@@ -316,22 +354,85 @@ export function addAccount(
   return newAccount;
 }
 
-function wipeAccountSessionFiles(id: string): void {
+export function wipeAccountSessionFiles(id: string): void {
   const profilePath = getAccountProfilePath(id);
   try {
     fs.rmSync(profilePath, { recursive: true, force: true });
-  } catch {}
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : String(error ?? "");
+    if (
+      message.includes("EPERM") ||
+      message.includes("EBUSY") ||
+      message.includes("Permission denied")
+    ) {
+      try {
+        const stalePath = `${profilePath}.stale-${Date.now()}`;
+        fs.renameSync(profilePath, stalePath);
+      } catch {}
+    }
+  }
   const siblingState = path.join(getProfilesDir(), `${id}_state.json`);
   try {
     fs.rmSync(siblingState, { force: true });
   } catch {}
 }
 
+export function removeAccountFromEnv(emailToRemove: string): void {
+  const target = emailToRemove.trim().toLowerCase();
+  const rawEnv = process.env.QWEN_ACCOUNTS;
+  if (!rawEnv) return;
+
+  const clean = (s: string) => s.trim().replace(/^[,;\s"'`]+|[,;\s"'`]+$/g, "").trim();
+  const lines = rawEnv.split(/[\r\n;]+/);
+  const remaining: string[] = [];
+
+  for (const rawLine of lines) {
+    const line = clean(rawLine);
+    if (!line) continue;
+
+    if (line.includes(",") && (line.match(/@/g) || []).length > 1) {
+      for (const seg of line.split(",")) {
+        const trimmed = clean(seg);
+        if (!trimmed) continue;
+        const colonIdx = trimmed.indexOf(":");
+        const email = clean(colonIdx !== -1 ? trimmed.substring(0, colonIdx) : trimmed);
+        if (email.toLowerCase() !== target && !isPlaceholderAccountEmail(email)) {
+          remaining.push(trimmed);
+        }
+      }
+    } else {
+      const colonIdx = line.indexOf(":");
+      const email = clean(colonIdx !== -1 ? line.substring(0, colonIdx) : line);
+      if (email.toLowerCase() !== target && !isPlaceholderAccountEmail(email)) {
+        remaining.push(line);
+      }
+    }
+  }
+
+  const newEnvValue = remaining.join(",");
+  process.env.QWEN_ACCOUNTS = newEnvValue;
+  lastSyncedEnv = newEnvValue;
+  lastSyncTime = Date.now();
+
+  if (!isRunningUnderNodeTest()) {
+    try {
+      updateEnvVariable("QWEN_ACCOUNTS", newEnvValue);
+    } catch {}
+  }
+}
+
 export function removeAccount(id: string): boolean {
   const db = getDatabase();
+  const account = db
+    .prepare("SELECT email FROM accounts WHERE id = ?")
+    .get(id) as { email: string } | undefined;
   const result = db.prepare("DELETE FROM accounts WHERE id = ?").run(id);
   if (result.changes > 0) {
     wipeAccountSessionFiles(id);
+    if (account?.email) {
+      removeAccountFromEnv(account.email);
+    }
   }
   invalidateAccountsCache();
   return result.changes > 0;

package/src/core/local-auth.ts

@@ -43,6 +43,58 @@ export function assertBindAllowed(host: string, apiKey: string): void {
   );
 }
 
+export function updateEnvVariable(
+  key: string,
+  value: string,
+  envPath = getEnvFilePath(),
+): void {
+  try {
+    const existing = fs.existsSync(envPath)
+      ? fs.readFileSync(envPath, "utf-8")
+      : "";
+    const regex = new RegExp(`^([ \\t]*)${key}[ \\t]*=.*$`, "m");
+    const assignment = regex.exec(existing);
+
+    let updated: string;
+    if (assignment) {
+      const start = assignment.index;
+      const end = start + assignment[0].length;
+      updated =
+        existing.slice(0, start) +
+        `${assignment[1]}${key}=${value}` +
+        existing.slice(end);
+    } else {
+      const lineEnding = existing.includes("\r\n") ? "\r\n" : "\n";
+      const prefix =
+        existing.length === 0 || existing.endsWith("\n") ? "" : lineEnding;
+      updated = `${existing}${prefix}${key}=${value}${lineEnding}`;
+    }
+
+    fs.writeFileSync(envPath, updated, { encoding: "utf-8", mode: 0o600 });
+  } catch (err) {
+    console.warn(
+      `⚠️  [Config] Could not update ${key} in .env:`,
+      err instanceof Error ? err.message : String(err),
+    );
+  }
+}
+
+export function persistServerPort(
+  port: number,
+  envPath = getEnvFilePath(),
+): void {
+  updateEnvVariable("PORT", String(port), envPath);
+  process.env.PORT = String(port);
+}
+
+export function persistCustomApiKey(
+  apiKey: string,
+  envPath = getEnvFilePath(),
+): void {
+  updateEnvVariable("API_KEY", apiKey.trim(), envPath);
+  process.env.API_KEY = apiKey.trim();
+}
+
 export function persistApiKey(
   apiKey: string,
   envPath = getEnvFilePath(),

package/src/core/paths.ts

@@ -181,6 +181,9 @@ export function getTuiSettingsPath(customDataDir?: string): string {
  * Path to user configuration .env file (either local or in global data dir).
  */
 export function getEnvFilePath(customDataDir?: string): string {
+  if (isRunningUnderNodeTest()) {
+    return path.join(customDataDir || getDataDir(), ".env");
+  }
   const localEnv = path.resolve(".env");
   if (fs.existsSync(localEnv)) {
     return localEnv;

package/src/login.ts

@@ -1,3 +1,4 @@
+import crypto from "crypto";
 import {
   addAccount,
   removeAccount,
@@ -76,30 +77,76 @@ async function addAccountFlow() {
   clear();
   console.log("=== Add New Account ===\n");
   const email = await askQuestion("Email: ");
-  if (!email) {
+  if (!email || !email.trim()) {
     console.log("Email is required.");
     await askQuestion("Press Enter to continue...");
     return;
   }
 
   const password = await askQuestion("Password: ");
-  if (!password) {
+  if (!password || !password.trim()) {
     console.log("Password is required.");
     await askQuestion("Press Enter to continue...");
     return;
   }
 
+  const trimmedEmail = email.trim();
+  const trimmedPassword = password.trim();
+
+  const existingAccounts = listAccounts();
+  if (
+    existingAccounts.some(
+      (a) => a.email.toLowerCase() === trimmedEmail.toLowerCase(),
+    )
+  ) {
+    console.log(
+      `\n❌ Error: An account with email "${trimmedEmail}" already exists.`,
+    );
+    await askQuestion("Press Enter to continue...");
+    return;
+  }
+
+  const tempId = crypto.randomUUID();
+  console.log(
+    `\n⏳ Validating credentials for ${maskEmail(trimmedEmail)} with Qwen via Playwright...`,
+  );
+
   let account: QwenAccount | null = null;
   try {
-    account = addAccount(email, password);
-    console.log(`Account added: ${maskEmail(account.email)} (${account.id})`);
-    console.log("Credentials will be validated by Playwright on server start.");
+    const { validateAccountLogin } = await import("./services/playwright.ts");
+    const { wipeAccountSessionFiles } = await import("./core/accounts.ts");
+    const { clearAccountCooldown } = await import("./core/account-manager.ts");
+    const { config } = await import("./core/config.ts");
+
+    const ok = await validateAccountLogin(
+      { id: tempId, email: trimmedEmail, password: trimmedPassword },
+      config.playwright.headless,
+      config.playwright.browser,
+    );
+
+    if (ok) {
+      account = addAccount(trimmedEmail, trimmedPassword, tempId);
+      console.log(
+        `\n✅ Account verified and saved: ${maskEmail(account.email)} (${account.id})`,
+      );
+    } else {
+      wipeAccountSessionFiles(tempId);
+      clearAccountCooldown(tempId);
+      console.log(
+        `\n❌ Authentication failed: Invalid credentials or unhandled login challenge.`,
+      );
+      console.log("The account was NOT saved.");
+    }
   } catch (err: any) {
-    if (account) removeAccount(account.id);
-    console.log(`\nError: ${err.message}`);
+    const { wipeAccountSessionFiles } = await import("./core/accounts.ts");
+    const { clearAccountCooldown } = await import("./core/account-manager.ts");
+    wipeAccountSessionFiles(tempId);
+    clearAccountCooldown(tempId);
+    console.log(`\n❌ Validation error: ${err?.message || String(err)}`);
+    console.log("The account was NOT saved.");
   }
 
-  await askQuestion("Press Enter to continue...");
+  await askQuestion("\nPress Enter to continue...");
 }
 
 async function removeAccountFlow() {

package/src/routes/chat/errors.ts

@@ -34,6 +34,14 @@ export function parseQwenErrorPayload(
 
   try {
     const payload = JSON.parse(text);
+    if (payload && (payload.update_member || payload.data?.update_member)) {
+      return {
+        code: "MembershipLimit",
+        details: "Account membership limit reached",
+        message: "Qwen upstream error: MembershipLimit: Account membership limit reached",
+        status: 429,
+      };
+    }
     if (payload && payload.success === false) {
       const code = payload.data?.code || payload.code || "UpstreamError";
       const details =

package/src/routes/chat/retry-policy.ts

@@ -242,6 +242,8 @@ export function isQuotaLikeError(err: unknown): boolean {
   return (
     code === "quota_limit" ||
     code === "ratelimited" ||
+    code === "membership_limit" ||
+    code === "membershiplimit" ||
     message.includes("quota_limit") ||
     message.includes("quota exceeded") ||
     message.includes("allocated quota") ||
@@ -253,11 +255,16 @@ export function isQuotaLikeError(err: unknown): boolean {
     message.includes("rate increased too quickly") ||
     message.includes("upper limit for today's usage") ||
     message.includes("you've reached the upper limit") ||
+    message.includes("membership_limit") ||
+    message.includes("membership limit") ||
+    message.includes("update_member") ||
+    message.includes("update member") ||
     // Accept local rate_limit code only when message also looks like quota/rate
     (code === "rate_limit_exceeded" &&
       (message.includes("quota") ||
         message.includes("rate") ||
         message.includes("limit") ||
+        message.includes("membership") ||
         message.includes("demanda") ||
         message.includes("demand")))
   );

package/src/routes/chat/streaming.ts

@@ -18,7 +18,7 @@ import {
   setToolCapNotice,
 } from "../../services/qwen.ts";
 import { acquireUpstreamStream } from "./account.ts";
-import { markAccountRateLimited } from "../../core/account-manager.ts";
+import { markAccountRateLimited, computeQuotaCooldownMs } from "../../core/account-manager.ts";
 import {
   clearTemporaryBusy,
   markAccountTemporarilyBusy,
@@ -438,6 +438,20 @@ export async function processNonStreamingResponse(
           ) {
             const delta = chunk.choices[0].delta;
 
+            if (delta.extra?.update_member || chunk.update_member) {
+              throw toRetryableStreamError(
+                "membership_limit",
+                "Qwen upstream membership limit reached (update_member); rotating account",
+                {
+                  switchAccount: true,
+                  forceNewChat: true,
+                  reason: "membership_limit",
+                  accountCooldownMs: computeQuotaCooldownMs(Date.now()),
+                  accountCooldownReason: "MembershipLimit",
+                },
+              );
+            }
+
             if (isThinkingPhase(delta.phase)) {
               isThinkingChunk = true;
               const formattedSummary = extractThinkingContent(delta);
@@ -952,6 +966,11 @@ export async function processStreamingResponse(
 
       // Release the lease immediately. The stop request below is best-effort
       // and must never hold the account slot or block the next tool turn.
+      if (onStreamComplete) {
+        try {
+          onStreamComplete();
+        } catch {}
+      }
       retryContext.releaseAccountLease?.();
       retryContext.releaseAccountLease = null;
       removeStream(completionId);
@@ -1739,6 +1758,20 @@ export async function processStreamingResponse(
             ) {
               const delta = chunk.choices[0].delta;
 
+              if (delta.extra?.update_member || chunk.update_member) {
+                throw toRetryableStreamError(
+                  "membership_limit",
+                  "Qwen upstream membership limit reached (update_member); rotating account",
+                  {
+                    switchAccount: true,
+                    forceNewChat: true,
+                    reason: "membership_limit",
+                    accountCooldownMs: computeQuotaCooldownMs(Date.now()),
+                    accountCooldownReason: "MembershipLimit",
+                  },
+                );
+              }
+
               // Qwen streams may end with a {"status":"finished",
               // "phase":"answer"} delta and NO trailing [DONE]. Treat it as
               // the terminal event so we don't wait on the keep-alive
@@ -2624,11 +2657,17 @@ export async function processStreamingResponse(
       }
 
       // Release locks now that the stream is fully done
-      if (onStreamComplete) onStreamComplete();
+      if (onStreamComplete) {
+        try {
+          onStreamComplete();
+        } catch {}
+      }
 
       // Release account lease from transparent retry if active
       if (retryContext.releaseAccountLease) {
-        retryContext.releaseAccountLease();
+        try {
+          retryContext.releaseAccountLease();
+        } catch {}
         retryContext.releaseAccountLease = null;
       }
     }