qwenproxy-cli 1.2.9 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.2.9",
+  "version": "1.3.0",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {
@@ -26,8 +26,8 @@
     "reset": "npx tsx src/reset-cooldowns.ts",
     "purge": "npx tsx src/delete-chats.ts",
     "test": "npm run test:mock && npm run test:live",
-    "test:mock": "tsx --test --test-concurrency=1 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts",
-    "test:mock:fast": "tsx --test --test-concurrency=2 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts",
+    "test:mock": "tsx --test --test-concurrency=1 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts src/tests/auth-jwt-and-validation.test.ts src/tests/tui-port-and-key-modal.test.ts",
+    "test:mock:fast": "tsx --test --test-concurrency=2 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts src/tests/auth-jwt-and-validation.test.ts src/tests/tui-port-and-key-modal.test.ts",
     "test:live": "tsx --test src/tests/concurrentChat.test.ts src/tests/agenticStress.test.ts",
     "benchmark:proxy": "npx tsx src/benchmarks/proxy-baseline.ts",
     "typecheck": "tsc --noEmit"

package/src/api/server.ts

@@ -172,7 +172,13 @@ app.use("*", async (c, next) => {
     c.req.path === "/logs" ||
     c.req.path.startsWith("/logs") ||
     c.req.path.startsWith("/diagnostics") ||
-    c.req.path === "/favicon.ico";
+    c.req.path === "/favicon.ico" ||
+    c.req.path === "/v1/models" ||
+    c.req.path.startsWith("/v1/models/") ||
+    c.req.path === "/models" ||
+    c.req.path.startsWith("/models/") ||
+    c.req.path === "/v1/chat/mode" ||
+    c.req.path === "/chat/mode";
 
   if (!isProbe) {
     metrics.increment("requests.total");
@@ -445,7 +451,13 @@ app.onError((err, c) => {
     c.req.path === "/health" ||
     c.req.path === "/metrics" ||
     c.req.path.startsWith("/diagnostics") ||
-    c.req.path === "/favicon.ico";
+    c.req.path === "/favicon.ico" ||
+    c.req.path === "/v1/models" ||
+    c.req.path.startsWith("/v1/models/") ||
+    c.req.path === "/models" ||
+    c.req.path.startsWith("/models/") ||
+    c.req.path === "/v1/chat/mode" ||
+    c.req.path === "/chat/mode";
   if (!isProbe) {
     metrics.increment("requests.errors");
   }

package/src/core/accounts.ts

@@ -4,7 +4,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { getDatabase } from "./database.ts";
 import { decrypt, encrypt } from "./crypto-utils.ts";
-import { getAccountProfilePath, getProfilesDir } from "./paths.ts";
+import { getAccountProfilePath, getProfilesDir, isRunningUnderNodeTest } from "./paths.ts";
+import { updateEnvVariable } from "./local-auth.ts";
 
 export interface QwenAccount {
   id: string;
@@ -14,6 +15,29 @@ export interface QwenAccount {
   cooldown_reason?: string | null;
 }
 
+export function isPlaceholderAccountEmail(email: string, password?: string): boolean {
+  if (!email || typeof email !== "string") return false;
+  const clean = email.trim().toLowerCase();
+  if (
+    clean === "email1@example.com" ||
+    clean === "email2@example.com" ||
+    clean === "user@example.com" ||
+    clean === "test@example.com" ||
+    clean === "your-email@example.com" ||
+    clean.startsWith("email1@") ||
+    clean.startsWith("email2@")
+  ) {
+    return true;
+  }
+  if (
+    password &&
+    (password === "password1" || password === "password2" || password === "changeme")
+  ) {
+    return true;
+  }
+  return false;
+}
+
 function generateId(email: string): string {
   return crypto
     .createHash("md5")
@@ -59,10 +83,12 @@ function parseEnvAccounts(): QwenAccount[] {
       }
       const email = clean(trimmed.substring(0, colonIdx));
       const password = clean(trimmed.substring(colonIdx + 1));
-      if (!email || !password) {
-        console.warn(
-          `[Accounts] Invalid QWEN_ACCOUNTS entry at index ${index}: "${trimmed}"`,
-        );
+      if (!email || !password || isPlaceholderAccountEmail(email, password)) {
+        if (!email || !password) {
+          console.warn(
+            `[Accounts] Invalid QWEN_ACCOUNTS entry at index ${index}: "${trimmed}"`,
+          );
+        }
         return null;
       }
       return {
@@ -79,6 +105,17 @@ let lastSyncTime = 0;
 const SYNC_INTERVAL = 30_000;
 
 function syncEnvAccounts(): void {
+  const db = getDatabase();
+  // Automatically purge any dummy placeholder accounts that may have been seeded from .env.example
+  try {
+    db.prepare(`
+      DELETE FROM accounts
+      WHERE lower(email) IN ('email1@example.com', 'email2@example.com', 'user@example.com', 'test@example.com', 'your-email@example.com')
+         OR lower(email) LIKE 'email1@%'
+         OR lower(email) LIKE 'email2@%'
+    `).run();
+  } catch {}
+
   const envAccounts = process.env.QWEN_ACCOUNTS || "";
   const now = Date.now();
   if (envAccounts === lastSyncedEnv && now - lastSyncTime < SYNC_INTERVAL)
@@ -90,7 +127,6 @@ function syncEnvAccounts(): void {
   const accounts = parseEnvAccounts();
   if (accounts.length === 0) return;
 
-  const db = getDatabase();
   const upsert = db.prepare(`
     INSERT INTO accounts (id, email, password) VALUES (?, ?, ?)
     ON CONFLICT(email) DO UPDATE SET password = excluded.password, updated_at = datetime('now')
@@ -124,15 +160,17 @@ function getCachedAccounts(): QwenAccount[] {
     )
     .all() as QwenAccount[];
 
-  accountsCache = rows.map((row) => {
-    let password = "";
-    try {
-      password = decrypt(row.password);
-    } catch {
-      password = "";
-    }
-    return { ...row, password };
-  });
+  accountsCache = rows
+    .filter((row) => !isPlaceholderAccountEmail(row.email))
+    .map((row) => {
+      let password = "";
+      try {
+        password = decrypt(row.password);
+      } catch {
+        password = "";
+      }
+      return { ...row, password };
+    });
   accountsCacheTime = now;
   return accountsCache;
 }
@@ -316,22 +354,85 @@ export function addAccount(
   return newAccount;
 }
 
-function wipeAccountSessionFiles(id: string): void {
+export function wipeAccountSessionFiles(id: string): void {
   const profilePath = getAccountProfilePath(id);
   try {
     fs.rmSync(profilePath, { recursive: true, force: true });
-  } catch {}
+  } catch (error) {
+    const message =
+      error instanceof Error ? error.message : String(error ?? "");
+    if (
+      message.includes("EPERM") ||
+      message.includes("EBUSY") ||
+      message.includes("Permission denied")
+    ) {
+      try {
+        const stalePath = `${profilePath}.stale-${Date.now()}`;
+        fs.renameSync(profilePath, stalePath);
+      } catch {}
+    }
+  }
   const siblingState = path.join(getProfilesDir(), `${id}_state.json`);
   try {
     fs.rmSync(siblingState, { force: true });
   } catch {}
 }
 
+export function removeAccountFromEnv(emailToRemove: string): void {
+  const target = emailToRemove.trim().toLowerCase();
+  const rawEnv = process.env.QWEN_ACCOUNTS;
+  if (!rawEnv) return;
+
+  const clean = (s: string) => s.trim().replace(/^[,;\s"'`]+|[,;\s"'`]+$/g, "").trim();
+  const lines = rawEnv.split(/[\r\n;]+/);
+  const remaining: string[] = [];
+
+  for (const rawLine of lines) {
+    const line = clean(rawLine);
+    if (!line) continue;
+
+    if (line.includes(",") && (line.match(/@/g) || []).length > 1) {
+      for (const seg of line.split(",")) {
+        const trimmed = clean(seg);
+        if (!trimmed) continue;
+        const colonIdx = trimmed.indexOf(":");
+        const email = clean(colonIdx !== -1 ? trimmed.substring(0, colonIdx) : trimmed);
+        if (email.toLowerCase() !== target && !isPlaceholderAccountEmail(email)) {
+          remaining.push(trimmed);
+        }
+      }
+    } else {
+      const colonIdx = line.indexOf(":");
+      const email = clean(colonIdx !== -1 ? line.substring(0, colonIdx) : line);
+      if (email.toLowerCase() !== target && !isPlaceholderAccountEmail(email)) {
+        remaining.push(line);
+      }
+    }
+  }
+
+  const newEnvValue = remaining.join(",");
+  process.env.QWEN_ACCOUNTS = newEnvValue;
+  lastSyncedEnv = newEnvValue;
+  lastSyncTime = Date.now();
+
+  if (!isRunningUnderNodeTest()) {
+    try {
+      updateEnvVariable("QWEN_ACCOUNTS", newEnvValue);
+    } catch {}
+  }
+}
+
 export function removeAccount(id: string): boolean {
   const db = getDatabase();
+  const account = db
+    .prepare("SELECT email FROM accounts WHERE id = ?")
+    .get(id) as { email: string } | undefined;
   const result = db.prepare("DELETE FROM accounts WHERE id = ?").run(id);
   if (result.changes > 0) {
     wipeAccountSessionFiles(id);
+    if (account?.email) {
+      removeAccountFromEnv(account.email);
+    }
   }
   invalidateAccountsCache();
   return result.changes > 0;

package/src/core/local-auth.ts

@@ -43,6 +43,58 @@ export function assertBindAllowed(host: string, apiKey: string): void {
   );
 }
 
+export function updateEnvVariable(
+  key: string,
+  value: string,
+  envPath = getEnvFilePath(),
+): void {
+  try {
+    const existing = fs.existsSync(envPath)
+      ? fs.readFileSync(envPath, "utf-8")
+      : "";
+    const regex = new RegExp(`^([ \\t]*)${key}[ \\t]*=.*$`, "m");
+    const assignment = regex.exec(existing);
+
+    let updated: string;
+    if (assignment) {
+      const start = assignment.index;
+      const end = start + assignment[0].length;
+      updated =
+        existing.slice(0, start) +
+        `${assignment[1]}${key}=${value}` +
+        existing.slice(end);
+    } else {
+      const lineEnding = existing.includes("\r\n") ? "\r\n" : "\n";
+      const prefix =
+        existing.length === 0 || existing.endsWith("\n") ? "" : lineEnding;
+      updated = `${existing}${prefix}${key}=${value}${lineEnding}`;
+    }
+
+    fs.writeFileSync(envPath, updated, { encoding: "utf-8", mode: 0o600 });
+  } catch (err) {
+    console.warn(
+      `⚠️  [Config] Could not update ${key} in .env:`,
+      err instanceof Error ? err.message : String(err),
+    );
+  }
+}
+
+export function persistServerPort(
+  port: number,
+  envPath = getEnvFilePath(),
+): void {
+  updateEnvVariable("PORT", String(port), envPath);
+  process.env.PORT = String(port);
+}
+
+export function persistCustomApiKey(
+  apiKey: string,
+  envPath = getEnvFilePath(),
+): void {
+  updateEnvVariable("API_KEY", apiKey.trim(), envPath);
+  process.env.API_KEY = apiKey.trim();
+}
+
 export function persistApiKey(
   apiKey: string,
   envPath = getEnvFilePath(),

package/src/core/paths.ts

@@ -181,6 +181,9 @@ export function getTuiSettingsPath(customDataDir?: string): string {
  * Path to user configuration .env file (either local or in global data dir).
  */
 export function getEnvFilePath(customDataDir?: string): string {
+  if (isRunningUnderNodeTest()) {
+    return path.join(customDataDir || getDataDir(), ".env");
+  }
   const localEnv = path.resolve(".env");
   if (fs.existsSync(localEnv)) {
     return localEnv;

package/src/login.ts

@@ -1,3 +1,4 @@
+import crypto from "crypto";
 import {
   addAccount,
   removeAccount,
@@ -76,30 +77,76 @@ async function addAccountFlow() {
   clear();
   console.log("=== Add New Account ===\n");
   const email = await askQuestion("Email: ");
-  if (!email) {
+  if (!email || !email.trim()) {
     console.log("Email is required.");
     await askQuestion("Press Enter to continue...");
     return;
   }
 
   const password = await askQuestion("Password: ");
-  if (!password) {
+  if (!password || !password.trim()) {
     console.log("Password is required.");
     await askQuestion("Press Enter to continue...");
     return;
   }
 
+  const trimmedEmail = email.trim();
+  const trimmedPassword = password.trim();
+
+  const existingAccounts = listAccounts();
+  if (
+    existingAccounts.some(
+      (a) => a.email.toLowerCase() === trimmedEmail.toLowerCase(),
+    )
+  ) {
+    console.log(
+      `\n❌ Error: An account with email "${trimmedEmail}" already exists.`,
+    );
+    await askQuestion("Press Enter to continue...");
+    return;
+  }
+
+  const tempId = crypto.randomUUID();
+  console.log(
+    `\n⏳ Validating credentials for ${maskEmail(trimmedEmail)} with Qwen via Playwright...`,
+  );
+
   let account: QwenAccount | null = null;
   try {
-    account = addAccount(email, password);
-    console.log(`Account added: ${maskEmail(account.email)} (${account.id})`);
-    console.log("Credentials will be validated by Playwright on server start.");
+    const { validateAccountLogin } = await import("./services/playwright.ts");
+    const { wipeAccountSessionFiles } = await import("./core/accounts.ts");
+    const { clearAccountCooldown } = await import("./core/account-manager.ts");
+    const { config } = await import("./core/config.ts");
+
+    const ok = await validateAccountLogin(
+      { id: tempId, email: trimmedEmail, password: trimmedPassword },
+      config.playwright.headless,
+      config.playwright.browser,
+    );
+
+    if (ok) {
+      account = addAccount(trimmedEmail, trimmedPassword, tempId);
+      console.log(
+        `\n✅ Account verified and saved: ${maskEmail(account.email)} (${account.id})`,
+      );
+    } else {
+      wipeAccountSessionFiles(tempId);
+      clearAccountCooldown(tempId);
+      console.log(
+        `\n❌ Authentication failed: Invalid credentials or unhandled login challenge.`,
+      );
+      console.log("The account was NOT saved.");
+    }
   } catch (err: any) {
-    if (account) removeAccount(account.id);
-    console.log(`\nError: ${err.message}`);
+    const { wipeAccountSessionFiles } = await import("./core/accounts.ts");
+    const { clearAccountCooldown } = await import("./core/account-manager.ts");
+    wipeAccountSessionFiles(tempId);
+    clearAccountCooldown(tempId);
+    console.log(`\n❌ Validation error: ${err?.message || String(err)}`);
+    console.log("The account was NOT saved.");
   }
 
-  await askQuestion("Press Enter to continue...");
+  await askQuestion("\nPress Enter to continue...");
 }
 
 async function removeAccountFlow() {

package/src/routes/upload.ts

@@ -341,21 +341,22 @@ async function getSTSToken(
   filesize: number,
   filetype: string,
   headers: Record<string, string>,
+  accountId?: string,
 ): Promise<STSResponse["data"]> {
-  const response = await fetch(
-    qwenUrl("/api/v2/files/getstsToken"),
-    {
+  const doFetch = (reqHeaders: Record<string, string>) =>
+    fetch(qwenUrl("/api/v2/files/getstsToken"), {
       method: "POST",
       headers: buildQwenRequestHeaders({
-        cookie: headers.cookie,
-        userAgent: headers["user-agent"],
-        bxUa: headers["bx-ua"],
-        bxUmidtoken: headers["bx-umidtoken"],
-        bxV: headers["bx-v"],
+        cookie: reqHeaders.cookie,
+        userAgent: reqHeaders["user-agent"],
+        bxUa: reqHeaders["bx-ua"],
+        bxUmidtoken: reqHeaders["bx-umidtoken"],
+        bxV: reqHeaders["bx-v"],
       }),
       body: JSON.stringify({ filename, filesize: String(filesize), filetype }),
-    },
-  );
+    });
+
+  let response = await doFetch(headers);
 
   if (!response.ok) {
     const errorText = await response.text().catch(() => "");
@@ -364,8 +365,43 @@ async function getSTSToken(
     );
   }
 
-  const data = await response.json();
-  if (!data.success || !data.data) {
+  let data = await response.json().catch(() => null);
+  const is401 =
+    data?.success === false &&
+    (data?.data?.code === "Unauthorized" ||
+      (typeof data?.data?.details === "string" &&
+        data.data.details.includes("401")));
+
+  if (is401) {
+    try {
+      const { refreshHeaders } = await import("../services/playwright.ts");
+      const { getBasicHeaders } = await import("../services/auth-playwright.ts");
+      const { loadAccounts } = await import("../core/accounts.ts");
+      const resolvedId = accountId ?? loadAccounts()[0]?.id;
+      if (resolvedId) {
+        console.warn(
+          `[Upload] STS token 401 — refreshing session with re-auth and retrying...`,
+        );
+        await refreshHeaders(resolvedId, undefined, true);
+        const fresh = await getBasicHeaders(resolvedId);
+        headers.cookie = fresh.cookie;
+        headers["user-agent"] = fresh.userAgent;
+        headers["bx-v"] = fresh.bxV;
+        if (fresh.bxUa) headers["bx-ua"] = fresh.bxUa;
+        if (fresh.bxUmidtoken) headers["bx-umidtoken"] = fresh.bxUmidtoken;
+        response = await doFetch(headers);
+        if (response.ok) {
+          data = await response.json().catch(() => null);
+        }
+      }
+    } catch (refreshErr) {
+      console.warn(
+        `[Upload] Re-auth for STS token failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`,
+      );
+    }
+  }
+
+  if (!data?.success || !data?.data) {
     throw new Error(
       `STS token invalid: ${JSON.stringify(data).substring(0, 200)}`,
     );
@@ -617,6 +653,7 @@ export async function processImagesForQwen(
     file_url?: { url: string };
   }>,
   headers: Record<string, string>,
+  accountId?: string,
 ): Promise<{ text: string; files: QwenFileEntry[] }> {
   const textParts: string[] = [];
   const files: QwenFileEntry[] = [];
@@ -654,6 +691,7 @@ export async function processImagesForQwen(
             fileSize,
             typeInfo.qwenFileType,
             headers,
+            accountId,
           );
           fileUrl = await uploadToOSS(remoteMedia.buffer, stsData, filename);
           fileId = stsData.file_id;
@@ -686,6 +724,7 @@ export async function processImagesForQwen(
             fileSize,
             typeInfo.qwenFileType,
             headers,
+            accountId,
           );
           fileUrl = await uploadToOSS(buffer, stsData, filename);
           fileId = stsData.file_id;

package/src/services/auth-playwright.ts

@@ -94,36 +94,13 @@ export async function getBasicHeaders(accountId?: string): Promise<{
   return getPlaywrightBasicHeaders(resolvedAccountId);
 }
 
-export function isTokenExpiringSoon(
-  cookie: string,
-  minutesBeforeExpiry = 5,
-): boolean {
-  const tokenMatch = cookie.match(/token=([^;]+)/);
-  if (!tokenMatch) return false;
-
-  try {
-    const token = decodeURIComponent(tokenMatch[1]);
-    const segments = token.split(".");
-    // Some Qwen deployments use opaque cookies. Treating those as expired
-    // forces expensive header capture on every personalization request.
-    if (segments.length !== 3 || !segments[1]) return false;
-
-    const payloadJson = Buffer.from(segments[1], "base64url").toString("utf-8");
-    const payload = JSON.parse(payloadJson);
-    const exp = payload.exp;
-    if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
-
-    const nowSec = Math.floor(Date.now() / 1000);
-    const thresholdSec = minutesBeforeExpiry * 60;
-    return exp - nowSec < thresholdSec;
-  } catch {
-    return false;
-  }
-}
+import { parseJwtExpiry, isTokenExpiringSoon } from "../utils/jwt.ts";
+export { parseJwtExpiry, isTokenExpiringSoon };
 
 export async function getQwenHeaders(
   forceNew = false,
   accountId?: string,
+  forceReauth = false,
 ): Promise<HeaderResult> {
   if (isAuthMockEnabled()) {
     const basic = await getBasicHeaders(accountId);
@@ -150,8 +127,8 @@ export async function getQwenHeaders(
 
   await ensurePlaywrightInitialized(resolvedAccountId);
 
-  if (forceNew) {
-    await refreshHeaders(resolvedAccountId);
+  if (forceNew || forceReauth) {
+    await refreshHeaders(resolvedAccountId, config.timeouts.headers, forceReauth);
   }
 
   const basic = await getPlaywrightBasicHeaders(resolvedAccountId);