qwenproxy-cli 1.3.0 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {

package/src/routes/chat/errors.ts

@@ -34,6 +34,14 @@ export function parseQwenErrorPayload(
 
   try {
     const payload = JSON.parse(text);
+    if (payload && (payload.update_member || payload.data?.update_member)) {
+      return {
+        code: "MembershipLimit",
+        details: "Account membership limit reached",
+        message: "Qwen upstream error: MembershipLimit: Account membership limit reached",
+        status: 429,
+      };
+    }
     if (payload && payload.success === false) {
       const code = payload.data?.code || payload.code || "UpstreamError";
       const details =

package/src/routes/chat/retry-policy.ts

@@ -242,6 +242,8 @@ export function isQuotaLikeError(err: unknown): boolean {
   return (
     code === "quota_limit" ||
     code === "ratelimited" ||
+    code === "membership_limit" ||
+    code === "membershiplimit" ||
     message.includes("quota_limit") ||
     message.includes("quota exceeded") ||
     message.includes("allocated quota") ||
@@ -253,11 +255,16 @@ export function isQuotaLikeError(err: unknown): boolean {
     message.includes("rate increased too quickly") ||
     message.includes("upper limit for today's usage") ||
     message.includes("you've reached the upper limit") ||
+    message.includes("membership_limit") ||
+    message.includes("membership limit") ||
+    message.includes("update_member") ||
+    message.includes("update member") ||
     // Accept local rate_limit code only when message also looks like quota/rate
     (code === "rate_limit_exceeded" &&
       (message.includes("quota") ||
         message.includes("rate") ||
         message.includes("limit") ||
+        message.includes("membership") ||
         message.includes("demanda") ||
         message.includes("demand")))
   );

package/src/routes/chat/streaming.ts

@@ -18,7 +18,7 @@ import {
   setToolCapNotice,
 } from "../../services/qwen.ts";
 import { acquireUpstreamStream } from "./account.ts";
-import { markAccountRateLimited } from "../../core/account-manager.ts";
+import { markAccountRateLimited, computeQuotaCooldownMs } from "../../core/account-manager.ts";
 import {
   clearTemporaryBusy,
   markAccountTemporarilyBusy,
@@ -438,6 +438,20 @@ export async function processNonStreamingResponse(
           ) {
             const delta = chunk.choices[0].delta;
 
+            if (delta.extra?.update_member || chunk.update_member) {
+              throw toRetryableStreamError(
+                "membership_limit",
+                "Qwen upstream membership limit reached (update_member); rotating account",
+                {
+                  switchAccount: true,
+                  forceNewChat: true,
+                  reason: "membership_limit",
+                  accountCooldownMs: computeQuotaCooldownMs(Date.now()),
+                  accountCooldownReason: "MembershipLimit",
+                },
+              );
+            }
+
             if (isThinkingPhase(delta.phase)) {
               isThinkingChunk = true;
               const formattedSummary = extractThinkingContent(delta);
@@ -952,6 +966,11 @@ export async function processStreamingResponse(
 
       // Release the lease immediately. The stop request below is best-effort
       // and must never hold the account slot or block the next tool turn.
+      if (onStreamComplete) {
+        try {
+          onStreamComplete();
+        } catch {}
+      }
       retryContext.releaseAccountLease?.();
       retryContext.releaseAccountLease = null;
       removeStream(completionId);
@@ -1739,6 +1758,20 @@ export async function processStreamingResponse(
             ) {
               const delta = chunk.choices[0].delta;
 
+              if (delta.extra?.update_member || chunk.update_member) {
+                throw toRetryableStreamError(
+                  "membership_limit",
+                  "Qwen upstream membership limit reached (update_member); rotating account",
+                  {
+                    switchAccount: true,
+                    forceNewChat: true,
+                    reason: "membership_limit",
+                    accountCooldownMs: computeQuotaCooldownMs(Date.now()),
+                    accountCooldownReason: "MembershipLimit",
+                  },
+                );
+              }
+
               // Qwen streams may end with a {"status":"finished",
               // "phase":"answer"} delta and NO trailing [DONE]. Treat it as
               // the terminal event so we don't wait on the keep-alive
@@ -2624,11 +2657,17 @@ export async function processStreamingResponse(
       }
 
       // Release locks now that the stream is fully done
-      if (onStreamComplete) onStreamComplete();
+      if (onStreamComplete) {
+        try {
+          onStreamComplete();
+        } catch {}
+      }
 
       // Release account lease from transparent retry if active
       if (retryContext.releaseAccountLease) {
-        retryContext.releaseAccountLease();
+        try {
+          retryContext.releaseAccountLease();
+        } catch {}
         retryContext.releaseAccountLease = null;
       }
     }

package/src/services/playwright.ts

@@ -379,14 +379,8 @@ export async function isPageLoggedIn(
           );
           if (!hasIdentity) return false;
 
-          // DOM check: if login button is prominently visible, not logged in
-          const loginBtn = document.querySelector(
-            ".header-right-auth-button, button.header-right-auth-button, a[href*='/auth'], a[href*='/login']",
-          );
-          if (loginBtn && (loginBtn as HTMLElement).offsetParent !== null) {
-            return false;
-          }
-
+          // If an authenticated user object is confirmed with a real user identity,
+          // the session is 100% valid and verified by upstream.
           return true;
         } catch {
           return false;
@@ -1502,13 +1496,14 @@ export async function initPlaywrightForAccount(
           await sleep(1500);
           const currentUrl = acctPage.url();
           const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
-          if (isAuthUrl) {
+          const loggedIn = !isAuthUrl && (await isPageLoggedIn(acctPage, 4_000));
+          if (!loggedIn) {
             if (account.email && account.password) {
               console.log(
-                `[Playwright] Session expired for ${maskEmail(account.email)}, re-authenticating...`,
+                `[Playwright] Session expired or guest state detected for ${maskEmail(account.email)}, re-authenticating...`,
               );
               const ok = await loginToQwen(account.id, account.email, account.password);
-              if (!ok || acctPage.url().includes("/auth") || acctPage.url().includes("/login")) {
+              if (!ok || !(await isPageLoggedIn(acctPage, 4_000))) {
                 validationError = new Error(
                   `Session expired for ${maskEmail(account.email)} and re-authentication failed`,
                 );
@@ -1894,94 +1889,94 @@ async function loginViaApi(
       .digest("hex");
     const signinUrl = qwenUrl("/api/v2/auths/signin");
 
-    const requestId = crypto.randomUUID();
-    const result = await page.evaluate(
-      async ({ email, password, signinUrl, requestId }) => {
-        try {
-          const response = await fetch(signinUrl, {
-            method: "POST",
-            signal: AbortSignal.timeout(10_000),
-            credentials: "include",
-            headers: {
-              accept: "application/json, text/plain, */*",
-              "content-type": "application/json",
-              source: "web",
-              timezone: new Date().toString().split(" (")[0],
-              "x-request-id": requestId,
-            },
-            body: JSON.stringify({ email, password, login_type: "email" }),
-          });
-          const data = await response.json().catch(() => null);
-          const token = data?.data?.token || data?.token;
-          if (token) {
+    let signinSuccess = false;
+    let data: any = null;
+
+    if (page.request && typeof page.request.post === "function") {
+      try {
+        const response = await page.request.post(signinUrl, {
+          data: {
+            email,
+            password: hashedPassword,
+            login_type: "email",
+          },
+          headers: {
+            "content-type": "application/json",
+            accept: "application/json, text/plain, */*",
+            referer: qwenUrl("/auth"),
+            origin: qwenOrigin(),
+          },
+          timeout: 10_000,
+        });
+        data = await response.json().catch(() => null);
+        signinSuccess = Boolean(data && (data.success === true || data.token));
+      } catch {}
+    }
+
+    if (!signinSuccess && !data) {
+      // Fallback to in-page evaluate fetch if page.request was unavailable
+      const requestId = crypto.randomUUID();
+      const evalRes = await page
+        .evaluate(
+          async ({ email, password, signinUrl, requestId }) => {
             try {
-              localStorage.setItem("token", token);
-              document.cookie = `token=${encodeURIComponent(token)}; path=/; domain=.qwen.ai; max-age=31536000`;
-            } catch {}
-          }
-          return { ok: response.ok, status: response.status, data, token };
-        } catch (e: any) {
-          return { ok: false, error: e.message };
-        }
-      },
-      { email, password: hashedPassword, signinUrl, requestId },
-    );
+              const response = await fetch(signinUrl, {
+                method: "POST",
+                signal: AbortSignal.timeout(10_000),
+                credentials: "include",
+                headers: {
+                  accept: "application/json, text/plain, */*",
+                  "content-type": "application/json",
+                  source: "web",
+                  timezone: new Date().toString().split(" (")[0],
+                  "x-request-id": requestId,
+                },
+                body: JSON.stringify({ email, password, login_type: "email" }),
+              });
+              const json = await response.json().catch(() => null);
+              return { ok: response.ok, status: response.status, data: json };
+            } catch (e: any) {
+              return { ok: false, error: e.message };
+            }
+          },
+          { email, password: hashedPassword, signinUrl, requestId },
+        )
+        .catch(() => null);
 
-    if (result.data) {
-      if (result.data.success === true || result.token) {
-        await page
-          .goto(qwenUrl("/"), {
-            waitUntil: "domcontentloaded",
-            timeout: config.timeouts.navigation,
-          })
-          .catch(() => {});
-        await sleep(1000);
-        const url = page.url();
-        const isLogged = !(url.includes("/auth") || url.includes("/login"));
-        if (isLogged) {
-          return { success: true };
-        }
-        const loggedIn = await isPageLoggedIn(page);
-        if (loggedIn) {
-          return { success: true };
-        }
-      } else if (result.data.success === false) {
-        const code = result.data?.data?.code || result.data?.code;
-        const details =
-          result.data?.data?.details ||
-          result.data?.details ||
-          result.data?.message;
-        const classified = classifyQwenAuthError(code, details);
-        return {
-          success: false,
-          permanentFailure: classified.isPermanent,
-          reason: classified.reason,
-        };
+      if (evalRes?.data) {
+        data = evalRes.data;
+        signinSuccess = Boolean(data && (data.success === true || data.token));
       }
     }
 
-    if (result.ok) {
+    if (data?.success === false) {
+      const code = data?.data?.code || data?.code;
+      const details = data?.data?.details || data?.details || data?.message;
+      const classified = classifyQwenAuthError(code, details);
+      return {
+        success: false,
+        permanentFailure: classified.isPermanent,
+        reason: classified.reason,
+      };
+    }
+
+    if (signinSuccess) {
       await page
         .goto(qwenUrl("/"), {
           waitUntil: "domcontentloaded",
           timeout: config.timeouts.navigation,
         })
         .catch(() => {});
-      await sleep(1000);
-      const url = page.url();
-      const isLogged = !(url.includes("/auth") || url.includes("/login"));
-      if (isLogged) {
+      await sleep(1500);
+      const loggedIn = await isPageLoggedIn(page, 4_000);
+      if (loggedIn) {
         return { success: true };
       }
-      const loggedIn = await isPageLoggedIn(page);
-      return {
-        success: loggedIn,
-        reason: loggedIn ? undefined : "Sessão não autenticada após signin",
-      };
     }
+
     return {
       success: false,
-      reason: result.error || `HTTP ${result.status || "desconhecido"} sem corpo JSON válido`,
+      reason: "API signin não confirmou sessão autenticada",
     };
   } catch (err: any) {
     const errMsg = err?.message || String(err);
@@ -2038,10 +2033,29 @@ async function loginViaUi(
       return { success: false, reason: "Campo de e-mail não encontrado (possível captcha)" };
     }
 
+    // In Qwen Web, if the page opens on the default email OTP panel, click "Log in with a password"
+    // to reveal the standard email + password form.
+    try {
+      const pwdModeBtn = page.getByText(/Log in with a password/i).first();
+      if (await pwdModeBtn.isVisible({ timeout: 1500 }).catch(() => false)) {
+        await pwdModeBtn.click().catch(() => {});
+        await sleep(500);
+      }
+    } catch {}
+
     // Fill email
     await page.fill(emailSelector, email);
     await sleep(300);
 
+    // If "Log in with a password" button appeared after typing email, click it
+    try {
+      const pwdModeBtn = page.getByText(/Log in with a password/i).first();
+      if (await pwdModeBtn.isVisible({ timeout: 1000 }).catch(() => false)) {
+        await pwdModeBtn.click().catch(() => {});
+        await sleep(500);
+      }
+    } catch {}
+
     // In Qwen Web, the password field is present on the same form.
     // NEVER press Enter after filling email alone, as Qwen interprets that
     // as a request to sign in via email verification code (passwordless OTP).
@@ -2071,7 +2085,7 @@ async function loginViaUi(
     // Prefer clicking the submit button; fall back to pressing Enter.
     // The button starts disabled and only enables once both fields are filled.
     const submitSelector =
-      'button[type="submit"].qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Sign in")';
+      'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in")';
     const submitButton = page.locator(submitSelector).first();
     try {
       await page.waitForSelector('button[type="submit"]:not([disabled])', {
@@ -2388,18 +2402,19 @@ export async function captureQwenHeaders(
       if (settled || page.isClosed()) return;
 
       // Session-expiry fast path: if the page landed on the auth/login screen
-      // (redirection after a dead session), typing into the chat input would
-      // burn every trigger attempt on a textarea that does not exist. Re-login
+      // or in a logged-out guest state, typing into the chat input would
+      // burn every trigger attempt on a textarea that does not submit. Re-login
       // immediately when credentials are available; otherwise fail fast with a
       // clear diagnosis instead of 3 pointless grace timeouts.
       const currentUrl = page.url();
       const isAuthUrl = currentUrl.includes("/auth") || currentUrl.includes("/login");
-      if (isAuthUrl) {
+      const loggedIn = !isAuthUrl && (await isPageLoggedIn(page, 3000));
+      if (!loggedIn) {
         const { getAccountCredentials } = await import("../core/accounts.ts");
         const creds = getAccountCredentials(accountId);
         if (creds && creds.email && creds.password) {
           console.warn(
-            `⚠️  [Playwright] Session expired during header capture for ${accountId}; re-authenticating...`,
+            `⚠️  [Playwright] Session expired or guest state detected during header capture for ${accountId}; re-authenticating...`,
           );
           const ok = await loginToQwen(accountId, creds.email, creds.password);
           if (ok) {
@@ -2407,7 +2422,7 @@ export async function captureQwenHeaders(
             // the check below probes a live authenticated chat page.
             await openChatPage();
           }
-          if (!ok || page.url().includes("/auth") || page.url().includes("/login")) {
+          if (!ok || !(await isPageLoggedIn(page, 4000))) {
             settle(
               new Error(
                 `Header capture failed for ${accountId}: re-login after session expiry did not succeed`,
@@ -2470,12 +2485,26 @@ export async function captureQwenHeaders(
         try {
           await page.focus(inputSelector, { timeout: inputActionTimeoutMs });
           if (settled || page.isClosed()) return;
-          await page.fill(inputSelector, "", { timeout: inputActionTimeoutMs });
-          if (settled || page.isClosed()) return;
-          await page.type(inputSelector, "a", {
-            delay: 100,
-            timeout: inputActionTimeoutMs,
-          });
+          await page.fill(inputSelector, "a", { timeout: inputActionTimeoutMs });
+          if (typeof page.evaluate === "function") {
+            await page.evaluate((sel) => {
+              const el = document.querySelector(sel) as HTMLTextAreaElement | null;
+              if (el) {
+                el.focus();
+                const nativeSetter = Object.getOwnPropertyDescriptor(
+                  window.HTMLTextAreaElement.prototype,
+                  "value",
+                )?.set;
+                if (nativeSetter) {
+                  nativeSetter.call(el, "a");
+                } else {
+                  el.value = "a";
+                }
+                el.dispatchEvent(new Event("input", { bubbles: true }));
+                el.dispatchEvent(new Event("change", { bubbles: true }));
+              }
+            }, inputSelector).catch(() => {});
+          }
           interactionSucceeded = true;
           break;
         } catch {
@@ -2505,6 +2534,9 @@ export async function captureQwenHeaders(
         ".message-input-right-button-send .send-button",
         ".chat-prompt-send-button",
         "button.send-button",
+        "button[aria-label*='Send' i]",
+        "button[aria-label*='Enviar' i]",
+        ".send-button-container button",
       ];
 
       let clicked = false;
@@ -2513,18 +2545,28 @@ export async function captureQwenHeaders(
         try {
           const btn = await page.$(selector);
           if (btn && (await btn.isVisible())) {
-            await page.evaluate((sel) => {
-              const element = document.querySelector(sel) as HTMLElement;
-              if (element) {
-                element.focus();
-                element.click();
+            const isDisabled = await page.evaluate((el) => {
+              const b = el as HTMLButtonElement;
+              return (
+                b.disabled ||
+                b.classList.contains("disabled") ||
+                b.getAttribute("aria-disabled") === "true"
+              );
+            }, btn);
+            if (!isDisabled) {
+              await page.evaluate((sel) => {
+                const element = document.querySelector(sel) as HTMLElement;
+                if (element) {
+                  element.focus();
+                  element.click();
+                }
+              }, selector);
+              if (!settled && !page.isClosed()) {
+                await btn.click({ force: true, delay: 50 }).catch(() => {});
               }
-            }, selector);
-            if (!settled && !page.isClosed()) {
-              await btn.click({ force: true, delay: 50 }).catch(() => {});
+              clicked = true;
+              break;
             }
-            clicked = true;
-            break;
           }
         } catch {
           // Try the next selector.

package/src/services/qwen.ts

@@ -985,12 +985,12 @@ export async function requestQwenSettingsDirectFetch(
     // passes the WAF.
     let json: any = null;
     let okShape = false;
-    if (contentType.includes("html")) {
+    if (contentType.includes("html") || !response.ok) {
       okShape = false;
     } else {
       try {
         json = JSON.parse(raw);
-        okShape = json && typeof json === "object" && "success" in json;
+        okShape = json && typeof json === "object" && json.success === true;
       } catch {
         okShape = false;
       }

package/src/tools/parser.ts

@@ -629,6 +629,9 @@ function coerceParameterValue(rawValue: string): unknown {
  */
 function extractToolName(openTag: string, block: string): string {
   const combined = `${openTag}\n${block}`;
+  const fnMatch = combined.match(/<function=([^\s>]+)>/i);
+  if (fnMatch) return fnMatch[1].trim();
+
   const attrMatch = combined.match(
     /<tool_call(?:s)?\b[^>]*\bname\s*=\s*["']([^"']+)["']/i,
   );
@@ -640,6 +643,48 @@ function extractToolName(openTag: string, block: string): string {
   return "";
 }
 
+/**
+ * Parse function shorthand XML <function=name><parameter=key>value</parameter></function> format.
+ */
+function parseFunctionShorthandToolCall(
+  block: string,
+  openTag: string,
+  tools: ToolDefinitionLike[],
+): { name: string; arguments: Record<string, unknown> } | null {
+  const combined = `${openTag}\n${block}`;
+  const fnMatch = combined.match(/<function=([^\s>]+)>/i);
+  let toolName = fnMatch ? fnMatch[1].trim() : "";
+
+  const args: Record<string, unknown> = {};
+  const parameterRe = /<parameter=([^\s>]+)>([\s\S]*?)<\/parameter>/gi;
+  let match: RegExpExecArray | null = parameterRe.exec(block);
+  while (match !== null) {
+    args[match[1]] = coerceParameterValue(match[2]);
+    match = parameterRe.exec(block);
+  }
+
+  // Also support <parameter name="..."> inside <function=...>
+  if (Object.keys(args).length === 0) {
+    const namedParamRe =
+      /<parameter\b[^>]*\bname\s*=\s*["']([^"']+)["'][^>]*>([\s\S]*?)<\/parameter>/gi;
+    let namedMatch: RegExpExecArray | null = namedParamRe.exec(block);
+    while (namedMatch !== null) {
+      args[namedMatch[1]] = coerceParameterValue(namedMatch[2]);
+      namedMatch = namedParamRe.exec(block);
+    }
+  }
+
+  if (Object.keys(args).length === 0) return null;
+
+  if (!toolName) {
+    toolName =
+      extractToolName(openTag, block) || inferToolNameFromParameters(args, tools);
+  }
+  if (!toolName) return null;
+
+  return { name: toolName, arguments: args };
+}
+
 /**
  * Infer tool name by matching parameter keys against tool definitions.
  * Only returns a name if exactly one tool matches all argument keys.
@@ -2193,6 +2238,47 @@ export class StreamingToolParser {
       });
     }
 
+    // 0) Try function shorthand format (<function=name><parameter=k>v</parameter></function>)
+    const fnShorthand = parseFunctionShorthandToolCall(
+      t,
+      this.currentOpenTag,
+      this.tools,
+    );
+    if (fnShorthand) {
+      const resolvedName = this.resolveDeclaredToolName(fnShorthand.name);
+      if (!resolvedName) {
+        this.recordMalformedToolCall(content, {
+          undeclaredNames: [fnShorthand.name],
+          category: "undeclared",
+        });
+        this.preserveLiteralToolCall(
+          content,
+          result,
+          `undeclared tool name: ${fnShorthand.name}`,
+        );
+        return;
+      }
+      fnShorthand.name = resolvedName;
+      if (isToolcallDebugEnabled()) {
+        logger.debug(
+          "[parser] processToolContent: function shorthand parsed successfully",
+          {
+            name: fnShorthand.name,
+            arguments: fnShorthand.arguments,
+          },
+        );
+      }
+      this.finalizeSuccessfulToolCall(
+        {
+          id: `call_${crypto.randomUUID()}`,
+          name: fnShorthand.name,
+          arguments: fnShorthand.arguments,
+        },
+        result,
+      );
+      return;
+    }
+
     // 1) Try Hermes-style XML <parameter> format first
     const xmlParsed = parseXmlParameterToolCall(
       t,
@@ -2488,6 +2574,23 @@ export class StreamingToolParser {
       });
     }
 
+    // Try function shorthand format first
+    const fnShorthand = parseFunctionShorthandToolCall(
+      block,
+      this.currentOpenTag,
+      this.tools,
+    );
+    if (fnShorthand) {
+      const resolvedName = this.resolveDeclaredToolName(fnShorthand.name);
+      if (resolvedName) {
+        return {
+          id: `call_${crypto.randomUUID()}`,
+          name: resolvedName,
+          arguments: fnShorthand.arguments,
+        };
+      }
+    }
+
     // Try full parse first
     const xmlParsed = parseXmlParameterToolCall(
       block,

package/src/tools/toolcall-tags.ts

@@ -32,12 +32,12 @@ function tagName(tag: string): string {
 
 /** All accepted open tag names (custom + legacy). */
 export function getOpenNames(): string[] {
-  return Array.from(new Set([tagName(TOOL_CALL_OPEN), "tool_call", "tool_calls"]));
+  return Array.from(new Set([tagName(TOOL_CALL_OPEN), "tool_call", "tool_calls", "function"]));
 }
 
 /** All accepted close tag names (custom + legacy). */
 export function getCloseNames(): string[] {
-  return Array.from(new Set([tagName(TOOL_CALL_CLOSE), "tool_call", "tool_calls", "tool"]));
+  return Array.from(new Set([tagName(TOOL_CALL_CLOSE), "tool_call", "tool_calls", "tool", "function"]));
 }
 
 /** Wrap a JSON payload in the canonical open/close tags. */