qwenproxy-cli 1.2.10 → 1.3.1

package/src/services/playwright.ts

@@ -81,6 +81,7 @@ import { qwenOrigin, qwenUrl } from "./qwen-url.ts";
 import { setWafContextResetListener } from "../core/waf-isolation.ts";
 import { updateQwenWebVersion, getQwenWebVersion } from "./qwen-headers.ts";
 import { getAccountProfilePath, getProfilesDir } from "../core/paths.ts";
+import { parseJwtExpiry, isTokenExpiringSoon } from "../utils/jwt.ts";
 
 type ContextInitHook = (context: BrowserContext) => Promise<void> | void;
 const contextInitHooks: ContextInitHook[] = [];
@@ -350,7 +351,37 @@ export async function isPageLoggedIn(
       .evaluate(async () => {
         try {
           const res = await fetch("/api/v1/auths/", { method: "GET" });
-          return res.status === 200;
+          if (res.status !== 200) return false;
+          const json: any = await res.json().catch(() => null);
+          if (!json) return false;
+          if (json.success === false) return false;
+          if (
+            json.code &&
+            json.code !== 200 &&
+            json.code !== "200" &&
+            json.code !== 0 &&
+            json.code !== "0"
+          ) {
+            return false;
+          }
+          const user = json.data?.user || json.data || json;
+          if (!user || typeof user !== "object") return false;
+          if (user.is_guest === true || user.is_login === false) return false;
+          const hasIdentity = Boolean(
+            user.id ||
+              user.user_id ||
+              user.userId ||
+              user.email ||
+              user.name ||
+              json.data?.token ||
+              json.token ||
+              user.token,
+          );
+          if (!hasIdentity) return false;
+
+          // If an authenticated user object is confirmed with a real user identity,
+          // the session is 100% valid and verified by upstream.
+          return true;
         } catch {
           return false;
         }
@@ -1062,16 +1093,22 @@ export async function getCookies(accountId: string): Promise<string> {
   }
 
   const page = accountPages.get(accountId);
-  if (!page) return "";
+  if (!page || typeof page.context !== "function") return "";
 
-  const cookies = await withTimeout(
-    page.context().cookies(),
-    config.timeouts.page,
-    `Cookie retrieval timed out for ${accountId}`,
-  );
-  const cookieStr = cookies.map((c) => `${c.name}=${c.value}`).join("; ");
-  cookieCaches.set(accountId, { cookie: cookieStr, timestamp: now });
-  return cookieStr;
+  try {
+    const context = page.context();
+    if (!context || typeof context.cookies !== "function") return "";
+    const cookies = await withTimeout(
+      context.cookies(),
+      config.timeouts.page,
+      `Cookie retrieval timed out for ${accountId}`,
+    );
+    const cookieStr = cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+    cookieCaches.set(accountId, { cookie: cookieStr, timestamp: now });
+    return cookieStr;
+  } catch {
+    return "";
+  }
 }
 
 export async function getBasicHeaders(accountId: string): Promise<{
@@ -1456,14 +1493,17 @@ export async function initPlaywrightForAccount(
             waitUntil: "domcontentloaded",
             timeout: config.timeouts.navigation,
           });
-          const loggedIn = await isPageLoggedIn(acctPage);
+          await sleep(1500);
+          const currentUrl = acctPage.url();
+          const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
+          const loggedIn = !isAuthUrl && (await isPageLoggedIn(acctPage, 4_000));
           if (!loggedIn) {
             if (account.email && account.password) {
-              console.warn(
-                `⚠️  [Playwright] Session expired for ${maskEmail(account.email)}, re-authenticating...`,
+              console.log(
+                `[Playwright] Session expired or guest state detected for ${maskEmail(account.email)}, re-authenticating...`,
               );
               const ok = await loginToQwen(account.id, account.email, account.password);
-              if (!ok || !(await isPageLoggedIn(acctPage))) {
+              if (!ok || !(await isPageLoggedIn(acctPage, 4_000))) {
                 validationError = new Error(
                   `Session expired for ${maskEmail(account.email)} and re-authentication failed`,
                 );
@@ -1649,14 +1689,22 @@ export async function validateAccountLogin(
             waitUntil: "domcontentloaded",
             timeout: config.timeouts.navigation,
           });
-          loggedIn = await isPageLoggedIn(acctPage);
-          if (!loggedIn && account.email && account.password) {
-            accountPages.set(account.id, acctPage);
-            try {
-              loggedIn = await loginToQwen(account.id, account.email, account.password);
-            } finally {
-              accountPages.delete(account.id);
+          await sleep(1500);
+          const currentUrl = acctPage.url();
+          const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
+          if (isAuthUrl) {
+            if (account.email && account.password) {
+              accountPages.set(account.id, acctPage);
+              try {
+                loggedIn = await loginToQwen(account.id, account.email, account.password);
+              } finally {
+                accountPages.delete(account.id);
+              }
+            } else {
+              loggedIn = false;
             }
+          } else {
+            loggedIn = true;
           }
         } catch {
           loggedIn = false;
@@ -1876,10 +1924,18 @@ async function loginViaApi(
 
     if (result.data) {
       if (result.data.success === true || result.token) {
-        await page.goto(qwenUrl("/"), {
-          waitUntil: "domcontentloaded",
-          timeout: config.timeouts.navigation,
-        });
+        await page
+          .goto(qwenUrl("/"), {
+            waitUntil: "domcontentloaded",
+            timeout: config.timeouts.navigation,
+          })
+          .catch(() => {});
+        await sleep(1000);
+        const url = page.url();
+        const isLogged = !(url.includes("/auth") || url.includes("/login"));
+        if (isLogged) {
+          return { success: true };
+        }
         const loggedIn = await isPageLoggedIn(page);
         if (loggedIn) {
           return { success: true };
@@ -1887,7 +1943,9 @@ async function loginViaApi(
       } else if (result.data.success === false) {
         const code = result.data?.data?.code || result.data?.code;
         const details =
-          result.data?.data?.details || result.data?.details || result.data?.message;
+          result.data?.data?.details ||
+          result.data?.details ||
+          result.data?.message;
         const classified = classifyQwenAuthError(code, details);
         return {
           success: false,
@@ -1898,10 +1956,18 @@ async function loginViaApi(
     }
 
     if (result.ok) {
-      await page.goto(qwenUrl("/"), {
-        waitUntil: "domcontentloaded",
-        timeout: config.timeouts.navigation,
-      });
+      await page
+        .goto(qwenUrl("/"), {
+          waitUntil: "domcontentloaded",
+          timeout: config.timeouts.navigation,
+        })
+        .catch(() => {});
+      await sleep(1000);
+      const url = page.url();
+      const isLogged = !(url.includes("/auth") || url.includes("/login"));
+      if (isLogged) {
+        return { success: true };
+      }
       const loggedIn = await isPageLoggedIn(page);
       return {
         success: loggedIn,
@@ -1913,8 +1979,17 @@ async function loginViaApi(
       reason: result.error || `HTTP ${result.status || "desconhecido"} sem corpo JSON válido`,
     };
   } catch (err: any) {
-    console.warn(`⚠️  [Playwright] API login error: ${err?.message || err}`);
-    return { success: false, reason: err?.message || String(err) };
+    const errMsg = err?.message || String(err);
+    if (page && !page.isClosed()) {
+      try {
+        await sleep(1500);
+        if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000))) {
+          return { success: true };
+        }
+      } catch {}
+    }
+    console.warn(`⚠️  [Playwright] API login error: ${errMsg}`);
+    return { success: false, reason: errMsg };
   }
 }
 
@@ -1924,14 +1999,17 @@ async function loginViaUi(
   password: string,
 ): Promise<LoginAttemptResult> {
   try {
+    if (page.url().startsWith(qwenOrigin()) && !page.url().includes("/auth") && !page.url().includes("/login")) {
+      return { success: true };
+    }
     await page.goto(qwenUrl("/auth"), {
       waitUntil: "domcontentloaded",
       timeout: config.timeouts.navigation,
     });
-    await sleep(2000);
+    await sleep(1500);
 
     // Check if already logged in
-    if (!page.url().includes("/auth")) {
+    if (!page.url().includes("/auth") && !page.url().includes("/login")) {
       return { success: true };
     }
 
@@ -1955,34 +2033,59 @@ async function loginViaUi(
       return { success: false, reason: "Campo de e-mail não encontrado (possível captcha)" };
     }
 
+    // In Qwen Web, if the page opens on the default email OTP panel, click "Log in with a password"
+    // to reveal the standard email + password form.
+    try {
+      const pwdModeBtn = page.getByText(/Log in with a password/i).first();
+      if (await pwdModeBtn.isVisible({ timeout: 1500 }).catch(() => false)) {
+        await pwdModeBtn.click().catch(() => {});
+        await sleep(500);
+      }
+    } catch {}
+
     // Fill email
     await page.fill(emailSelector, email);
+    await sleep(300);
 
-    // The password field may already be visible (single-step form) or only
-    // appear after submitting the email (two-step flow).
+    // If "Log in with a password" button appeared after typing email, click it
+    try {
+      const pwdModeBtn = page.getByText(/Log in with a password/i).first();
+      if (await pwdModeBtn.isVisible({ timeout: 1000 }).catch(() => false)) {
+        await pwdModeBtn.click().catch(() => {});
+        await sleep(500);
+      }
+    } catch {}
+
+    // In Qwen Web, the password field is present on the same form.
+    // NEVER press Enter after filling email alone, as Qwen interprets that
+    // as a request to sign in via email verification code (passwordless OTP).
     const passwordSelector =
       'input[type="password"], input[name="password"]';
-    const passwordAlreadyVisible = await page
-      .locator(passwordSelector)
-      .first()
-      .isVisible()
-      .catch(() => false);
-
-    if (!passwordAlreadyVisible) {
-      await page.keyboard.press("Enter");
+    try {
       await page.waitForSelector(passwordSelector, {
-        timeout: config.timeouts.page,
+        timeout: 10_000,
       });
+    } catch {
+      if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000))) {
+        return { success: true };
+      }
+      console.warn(
+        `⚠️  [Playwright] Password input not found on ${page.url()}`,
+      );
+      return {
+        success: false,
+        reason: "Campo de senha não encontrado na tela de autenticação",
+      };
     }
-    await sleep(500);
 
     // Fill password
     await page.fill(passwordSelector, password);
+    await sleep(500);
 
     // Prefer clicking the submit button; fall back to pressing Enter.
     // The button starts disabled and only enables once both fields are filled.
     const submitSelector =
-      'button[type="submit"].qwenchat-auth-pc-submit-button, button[type="submit"]';
+      'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in")';
     const submitButton = page.locator(submitSelector).first();
     try {
       await page.waitForSelector('button[type="submit"]:not([disabled])', {
@@ -2000,6 +2103,18 @@ async function loginViaUi(
       maxAttempts: config.captcha.maxAttempts,
       retryDelayMs: config.captcha.retryDelayMs,
     }).catch(() => {});
+
+    // Check if an OTP code verification screen appeared (e.g. 2FA / email verification code)
+    const codeSelector =
+      'input[placeholder*="code" i], input[placeholder*="código" i], input[name*="code" i]';
+    const codeInput = page.locator(codeSelector).first();
+    if (await codeInput.isVisible().catch(() => false)) {
+      return {
+        success: false,
+        reason: "Conta requer código de verificação enviado por e-mail (2FA/OTP)",
+      };
+    }
+
     // Check for UI error elements in DOM (Ant Design errors, alerts, toasts)
     const errorSelector = [
       ".qwen-chat-v2-toast-text",
@@ -2122,6 +2237,9 @@ export async function captureQwenHeaders(
             );
           }
         }
+        if (!headersCaptured) {
+          unmarkAccountHeadersReady(accountId);
+        }
         if (error) reject(error);
         else resolve();
       };
@@ -2230,7 +2348,10 @@ export async function captureQwenHeaders(
         // Ignore parse errors or missing postData
       }
 
-      if (!hasRequiredQwenHeaders(capturedHeaders)) {
+      if (
+        !hasRequiredQwenHeaders(capturedHeaders) ||
+        !hasValidAuthToken(capturedHeaders.cookie)
+      ) {
         // Not evidence the page is broken: the SDK also fires completions
         // before it has computed its token. The request still must never reach
         // Qwen, but the capture keeps its route and spends another send —
@@ -2281,23 +2402,27 @@ export async function captureQwenHeaders(
       if (settled || page.isClosed()) return;
 
       // Session-expiry fast path: if the page landed on the auth/login screen
-      // (redirection after a dead session), typing into the chat input would
-      // burn every trigger attempt on a textarea that does not exist. Re-login
+      // or in a logged-out guest state, typing into the chat input would
+      // burn every trigger attempt on a textarea that does not submit. Re-login
       // immediately when credentials are available; otherwise fail fast with a
       // clear diagnosis instead of 3 pointless grace timeouts.
-      const loggedIn = await isPageLoggedIn(
-        page,
-        Math.max(1_000, Math.min(remainingBudgetMs(), SESSION_PROBE_NAVIGATION_TIMEOUT_MS)),
-      );
+      const currentUrl = page.url();
+      const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
+      const loggedIn = !isAuthUrl && (await isPageLoggedIn(page, 3000));
       if (!loggedIn) {
         const { getAccountCredentials } = await import("../core/accounts.ts");
         const creds = getAccountCredentials(accountId);
         if (creds && creds.email && creds.password) {
           console.warn(
-            `⚠️  [Playwright] Session expired during header capture for ${accountId}; re-authenticating...`,
+            `⚠️  [Playwright] Session expired or guest state detected during header capture for ${accountId}; re-authenticating...`,
           );
           const ok = await loginToQwen(accountId, creds.email, creds.password);
-          if (!ok || !(await isPageLoggedIn(page))) {
+          if (ok) {
+            // Re-login navigated; load the chat page and wait for hydration so
+            // the check below probes a live authenticated chat page.
+            await openChatPage();
+          }
+          if (!ok || !(await isPageLoggedIn(page, 4000))) {
             settle(
               new Error(
                 `Header capture failed for ${accountId}: re-login after session expiry did not succeed`,
@@ -2305,9 +2430,6 @@ export async function captureQwenHeaders(
             );
             return;
           }
-          // Re-login navigated away; reload the chat page so the send below
-          // types into a live chat input (never leave the loop parked).
-          await openChatPage();
           if (settled || page.isClosed()) return;
         } else {
           settle(
@@ -2363,12 +2485,26 @@ export async function captureQwenHeaders(
         try {
           await page.focus(inputSelector, { timeout: inputActionTimeoutMs });
           if (settled || page.isClosed()) return;
-          await page.fill(inputSelector, "", { timeout: inputActionTimeoutMs });
-          if (settled || page.isClosed()) return;
-          await page.type(inputSelector, "a", {
-            delay: 100,
-            timeout: inputActionTimeoutMs,
-          });
+          await page.fill(inputSelector, "a", { timeout: inputActionTimeoutMs });
+          if (typeof page.evaluate === "function") {
+            await page.evaluate((sel) => {
+              const el = document.querySelector(sel) as HTMLTextAreaElement | null;
+              if (el) {
+                el.focus();
+                const nativeSetter = Object.getOwnPropertyDescriptor(
+                  window.HTMLTextAreaElement.prototype,
+                  "value",
+                )?.set;
+                if (nativeSetter) {
+                  nativeSetter.call(el, "a");
+                } else {
+                  el.value = "a";
+                }
+                el.dispatchEvent(new Event("input", { bubbles: true }));
+                el.dispatchEvent(new Event("change", { bubbles: true }));
+              }
+            }, inputSelector).catch(() => {});
+          }
           interactionSucceeded = true;
           break;
         } catch {
@@ -2398,6 +2534,9 @@ export async function captureQwenHeaders(
         ".message-input-right-button-send .send-button",
         ".chat-prompt-send-button",
         "button.send-button",
+        "button[aria-label*='Send' i]",
+        "button[aria-label*='Enviar' i]",
+        ".send-button-container button",
       ];
 
       let clicked = false;
@@ -2406,18 +2545,28 @@ export async function captureQwenHeaders(
         try {
           const btn = await page.$(selector);
           if (btn && (await btn.isVisible())) {
-            await page.evaluate((sel) => {
-              const element = document.querySelector(sel) as HTMLElement;
-              if (element) {
-                element.focus();
-                element.click();
+            const isDisabled = await page.evaluate((el) => {
+              const b = el as HTMLButtonElement;
+              return (
+                b.disabled ||
+                b.classList.contains("disabled") ||
+                b.getAttribute("aria-disabled") === "true"
+              );
+            }, btn);
+            if (!isDisabled) {
+              await page.evaluate((sel) => {
+                const element = document.querySelector(sel) as HTMLElement;
+                if (element) {
+                  element.focus();
+                  element.click();
+                }
+              }, selector);
+              if (!settled && !page.isClosed()) {
+                await btn.click({ force: true, delay: 50 }).catch(() => {});
               }
-            }, selector);
-            if (!settled && !page.isClosed()) {
-              await btn.click({ force: true, delay: 50 }).catch(() => {});
+              clicked = true;
+              break;
             }
-            clicked = true;
-            break;
           }
         } catch {
           // Try the next selector.
@@ -2550,25 +2699,63 @@ async function getCookieSnapshot(
   }
 }
 
+/**
+ * Check whether a raw cookie header string contains a valid, non-empty auth token.
+ */
+export function hasValidAuthToken(cookieHeader?: string): boolean {
+  if (!cookieHeader || typeof cookieHeader !== "string") return false;
+  const match = cookieHeader.match(/(?:^|;\s*)token=([^;]+)/);
+  if (!match || !match[1]) return false;
+  const value = match[1].trim();
+  if (
+    value === "" ||
+    value === '""' ||
+    value === "''" ||
+    value === "null" ||
+    value === "undefined"
+  ) {
+    return false;
+  }
+  return true;
+}
+
 /**
  * Check if the auth token cookie is still valid.
  * Used to skip unnecessary header recaptures when the token is still fresh.
+ * Inspects the JWT exp claim when present rather than relying on cookie Max-Age.
  * Returns true if the token cookie exists and is not expired.
  */
-function isAuthTokenValidFrom(cookies: CookieSnapshot): boolean {
+export function isAuthTokenValidFrom(
+  cookies: CookieSnapshot,
+  safetyMarginMs = 5 * 60 * 1000,
+): boolean {
   const tokenCookie = cookies.find(
     (c) =>
       c.name === "token" && (c.domain === ".qwen.ai" || c.domain === "qwen.ai"),
   );
 
-  if (!tokenCookie) return false;
+  if (
+    !tokenCookie ||
+    !tokenCookie.value ||
+    tokenCookie.value.trim() === "" ||
+    tokenCookie.value.trim() === '""'
+  ) {
+    return false;
+  }
+
+  // If the token is a JWT, check its exp claim rather than the 1-year cookie Max-Age
+  const jwtExpSec = parseJwtExpiry(tokenCookie.value);
+  if (typeof jwtExpSec === "number" && Number.isFinite(jwtExpSec)) {
+    const expMs = jwtExpSec * 1000;
+    return expMs > Date.now() + safetyMarginMs;
+  }
 
   // Session cookie (expires = -1) is valid as long as browser is open
   if (tokenCookie.expires === -1) return true;
 
-  // Check if expired (with 5-min safety margin)
+  // Opaque token fallback: check cookie expiration with safety margin
   const expiresAt = tokenCookie.expires * 1000;
-  return expiresAt > Date.now() + 5 * 60 * 1000;
+  return expiresAt > Date.now() + safetyMarginMs;
 }
 
 /**
@@ -2591,6 +2778,7 @@ function isShortestCookieValidFrom(cookies: CookieSnapshot): boolean {
 async function refreshHeadersInternal(
   accountId: string,
   timeoutMs = config.timeouts.headers,
+  forceReauth = false,
 ): Promise<void> {
   const cache = getHeaderCache(accountId);
   if (cache.refreshInProgress) return;
@@ -2602,41 +2790,54 @@ async function refreshHeadersInternal(
     // Check if session is expired before capturing headers
     const page = accountPages.get(accountId);
     if (page) {
-      try {
-        await page.goto(qwenUrl("/"), {
-          waitUntil: "domcontentloaded",
-          timeout: Math.min(
-            config.timeouts.navigation,
-            boundedTimeoutMs,
-            SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
-          ),
-        });
-        const url = page.url();
-        const isAuthUrl = url.includes("auth") || url.includes("login");
-        const isLoggedIn = isAuthUrl ? false : await isPageLoggedIn(page, 5_000);
-        if (isAuthUrl || !isLoggedIn) {
-          console.warn(
-            `⚠️  [Playwright] Session expired during refresh for ${accountId}, re-authenticating...`,
-          );
-          const { getAccountCredentials } = await import("../core/accounts.ts");
-          const creds = getAccountCredentials(accountId);
-          if (creds && creds.email && creds.password) {
-            await loginToQwen(accountId, creds.email, creds.password);
-            cookieCaches.delete(accountId);
-            if (!(await isPageLoggedIn(page, 5_000))) {
-              throw new Error(`Re-login for ${accountId} did not restore an authenticated session`);
-            }
-          } else {
-            console.warn(
-              `[Playwright] No credentials available for re-login of ${accountId}`,
+      const executeReauth = async () => {
+        console.warn(
+          `⚠️  [Playwright] Session expired or forced re-auth for ${accountId}, re-authenticating...`,
+        );
+        const { getAccountCredentials } = await import("../core/accounts.ts");
+        const creds = getAccountCredentials(accountId);
+        if (creds && creds.email && creds.password) {
+          const ok = await loginToQwen(accountId, creds.email, creds.password);
+          cookieCaches.delete(accountId);
+          if (!ok || !(await isPageLoggedIn(page, 5_000))) {
+            unmarkAccountHeadersReady(accountId);
+            throw new Error(
+              `Re-login for ${accountId} did not restore an authenticated session`,
             );
           }
+        } else {
+          unmarkAccountHeadersReady(accountId);
+          throw new Error(
+            `No credentials available for re-login of ${accountId}`,
+          );
+        }
+      };
+
+      if (forceReauth) {
+        await executeReauth();
+      } else {
+        try {
+          await page.goto(qwenUrl("/"), {
+            waitUntil: "domcontentloaded",
+            timeout: Math.min(
+              config.timeouts.navigation,
+              boundedTimeoutMs,
+              SESSION_PROBE_NAVIGATION_TIMEOUT_MS,
+            ),
+          });
+          await sleep(2000);
+          const url = page.url();
+          const isAuthUrl = url.includes("auth") || url.includes("login");
+          if (isAuthUrl) {
+            await executeReauth();
+          }
+        } catch (navErr) {
+          console.warn(
+            `[Playwright] Navigation check failed during refresh for ${accountId}:`,
+            (navErr as Error).message,
+          );
+          await executeReauth();
         }
-      } catch (navErr) {
-        console.warn(
-          `[Playwright] Navigation check failed during refresh for ${accountId}:`,
-          (navErr as Error).message,
-        );
       }
     }
 
@@ -2666,6 +2867,7 @@ async function refreshHeadersInternal(
 export async function refreshHeaders(
   accountId: string,
   timeoutMs = config.timeouts.headers,
+  forceReauth = false,
 ): Promise<void> {
   const boundedTimeoutMs = Math.max(1_000, timeoutMs);
   const release = await acquireAccountMutex(
@@ -2674,7 +2876,7 @@ export async function refreshHeaders(
     boundedTimeoutMs,
   );
   try {
-    await refreshHeadersInternal(accountId, timeoutMs);
+    await refreshHeadersInternal(accountId, timeoutMs, forceReauth);
   } finally {
     release();
   }
@@ -2691,6 +2893,11 @@ export async function withAccountPage<T>(
   mutexTimeoutMs = PLAYWRIGHT_MUTEX_WAIT_MS,
   recoverOnTimeout = true,
 ): Promise<T> {
+  const inFlightInit = inFlightAccountInits.get(accountId);
+  if (inFlightInit) {
+    await inFlightInit.catch(() => {});
+  }
+
   const page = accountPages.get(accountId);
   if (!page || page.isClosed()) {
     throw new Error(`Playwright page unavailable for account: ${accountId}`);
@@ -3172,6 +3379,25 @@ export async function keepAlivePlaywrightAccount(
 
     const now = Date.now();
     const currentUrl = page.url();
+
+    // Proactive session check: if token expires within 45 minutes, refresh proactively
+    const cookie = await getCookies(accountId);
+    if (cookie && isTokenExpiringSoon(cookie, 45)) {
+      console.log(
+        `💓 [SessionKeeper] Account ${accountId} token expires within 45m; proactively renewing session...`,
+      );
+      try {
+        await refreshHeadersInternal(accountId, config.timeouts.headers, true);
+        lastKeepAliveNavigation.set(accountId, now);
+        touchAccountActivity(accountId);
+        return true;
+      } catch (err) {
+        console.warn(
+          `[SessionKeeper] Proactive session renewal failed for ${accountId}: ${getErrorMessage(err)}`,
+        );
+      }
+    }
+
     const lastNavigation = lastKeepAliveNavigation.get(accountId) ?? 0;
     const shouldNavigate =
       !currentUrl.startsWith(qwenOrigin()) ||