qwenproxy-cli 1.3.5 → 1.4.0

package/src/services/qwen-chat-pool.ts

@@ -9,6 +9,7 @@ import {
 import { mapClientModelToQwen } from "../core/model-alias.ts";
 import { qwenUrl } from "./qwen-url.ts";
 import { QwenUpstreamError } from "./qwen-errors.ts";
+import { looksLikeAntiBotChallengeText } from "./media-generation.ts";
 import {
   requestQwenTextInBrowser,
   buildCapturedQwenHeaders,
@@ -57,6 +58,31 @@ async function createQwenChatSession(
     json?.data?.chat?.id;
 
   if (!chatId || typeof chatId !== "string") {
+    const rawLower = raw.toLowerCase();
+    if (looksLikeAntiBotChallengeText(raw)) {
+      try {
+        const { recoverBaxiaCaptcha } = await import("./captcha-coordinator.ts");
+        const solved = await recoverBaxiaCaptcha(accountId, "createQwenChatSession", {
+          challengeBody: raw,
+        });
+        if (solved) {
+          return createQwenChatSession(headers, model, accountId, chatMode);
+        }
+      } catch {}
+    }
+
+    if (
+      json?.data?.code === "Unauthorized" ||
+      json?.code === "Unauthorized" ||
+      rawLower.includes("unauthorized") ||
+      rawLower.includes("permission to access")
+    ) {
+      throw new QwenUpstreamError(
+        `Qwen create chat unauthorized: ${raw.substring(0, 300)}`,
+        "Unauthorized",
+        401,
+      );
+    }
     throw new QwenUpstreamError(
       `Qwen create chat returned unexpected payload: ${raw.substring(0, 300)}`,
       "CreateChatInvalidResponse",

package/src/services/qwen-headers.ts

@@ -89,6 +89,14 @@ export function buildQwenRequestHeaders(
     "sec-ch-ua-platform": opts.secChUaPlatform || '"Windows"',
   };
 
+  const tokenMatch = opts.cookie?.match(/(?:^|;\s*)token=([^;]+)/);
+  if (tokenMatch && !headers["Authorization"] && !headers["authorization"]) {
+    const bearer = decodeURIComponent(tokenMatch[1].trim());
+    if (bearer && bearer !== '""' && bearer !== "null") {
+      headers["Authorization"] = `Bearer ${bearer}`;
+    }
+  }
+
   // The real chat.qwen.ai client sends ONLY bx-v on API requests — the WAF
   // carries bx-ua/bx-umidtoken as browser cookies, not headers. Match that
   // unless QWEN_SEND_BX_UA=true restores the legacy injection.

package/src/services/qwen.ts

@@ -663,8 +663,18 @@ const QWEN_SAFE_SETTINGS_PATCH = {
     autoTags: false,
     largeTextAsFile: false,
     splitLargeChunks: false,
+    title: {
+      auto: false,
+    },
+    notificationEnabled: false,
   },
   mcp_remind: false,
+  mcp: {
+    "code-interpreter": false,
+    "fire-crawl": false,
+    amap: false,
+    "image-generation": false,
+  },
   memory: {
     enable_memory: false,
     enable_history_memory: false,
@@ -680,6 +690,10 @@ const QWEN_SAFE_SETTINGS_PATCH = {
     image_edit_tool: false,
     bio: false,
     image_zoom_in_tool: false,
+    image_search: false,
+  },
+  extension: {
+    show_guide: false,
   },
 } as const;
 
@@ -813,6 +827,7 @@ function getBrowserFetchHeaders(
   const browserAllowedHeaders = new Set([
     "accept",
     "content-type",
+    "authorization",
     "bx-ua",
     "bx-umidtoken",
     "bx-v",
@@ -1573,6 +1588,7 @@ export async function syncQwenRequestPersonalization(
         existingJson?.data?.ui?.largeTextAsFile === false &&
         existingJson?.data?.ui?.splitLargeChunks === false &&
         existingJson?.data?.ui?.autoTags === false &&
+        existingJson?.data?.ui?.title?.auto === false &&
         existingJson?.data?.mcp_remind === false &&
         existingJson?.data?.memory?.enable_memory === false &&
         existingJson?.data?.memory?.enable_history_memory === false &&
@@ -1669,6 +1685,7 @@ export async function syncQwenRequestPersonalization(
       `[Qwen] Personalization 401 — refreshing session with re-auth and retrying | account=${cacheKey}`,
     );
     try {
+      currentSettings = null;
       const { headers: freshHeaders } = await getQwenHeaders(true, accountId, true);
       requestHeaders = buildCapturedQwenHeaders(freshHeaders, {
         referer: qwenUrl("/settings/personalization"),
@@ -1977,53 +1994,104 @@ function formatPublicQwenModel(model: Record<string, unknown>): PublicQwenModel
 }
 
 export async function deleteAllQwenChats(accountId?: string): Promise<boolean> {
-  let requestHeaders: Record<string, string>;
   if (isAuthMockEnabled()) {
     const { headers } = await getQwenHeaders(false, accountId);
-    requestHeaders = buildCapturedQwenHeaders(headers, {
+    const requestHeaders = buildCapturedQwenHeaders(headers, {
       referer: qwenUrl("/settings/chats"),
     });
-  } else {
-    // In live mode, requestQwenTextInBrowser executes inside the authenticated
-    // browser page where session cookies are attached automatically.
-    // Bypassing getQwenHeaders avoids triggering captureQwenHeaders (which sends
-    // a dummy chat completion to intercept anti-fraud tokens not needed for deletions).
-    requestHeaders = {
-      source: "web",
-      version: "0.2.89",
-      timezone: new Date().toString().split(" (")[0],
-      "x-request-id": crypto.randomUUID(),
-      Referer: qwenUrl("/settings/chats"),
-    };
-  }
-
-  const response = await requestQwenTextInBrowser(
-    accountId,
-    "DELETE",
-    "/api/v2/chats/",
-    requestHeaders,
-    undefined,
-    { referrer: qwenUrl("/settings/chats") },
-  );
 
-  const { raw, json: parsed } = await readJsonTextResponse(response, {
-    strict: true,
-  });
-  if (!response.ok) {
-    throw new Error(
-      `Failed to delete chats from Qwen: ${response.status} ${raw.substring(0, 200)}`,
+    const response = await requestQwenTextInBrowser(
+      accountId,
+      "DELETE",
+      "/api/v2/chats/",
+      requestHeaders,
+      undefined,
+      { referrer: qwenUrl("/settings/chats") },
     );
+
+    const { raw, json: parsed } = await readJsonTextResponse(response, {
+      strict: true,
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Failed to delete chats from Qwen: ${response.status} ${raw.substring(0, 200)}`,
+      );
+    }
+
+    const success = parsed?.success === true && parsed?.data?.status === true;
+    if (!success) {
+      throw new Error(
+        `Qwen delete chats returned unexpected payload: ${raw.substring(0, 200)}`,
+      );
+    }
+
+    clearAllSessionsForAccount(accountId || "global");
+    return true;
   }
 
-  const success = parsed?.success === true && parsed?.data?.status === true;
-  if (!success) {
-    throw new Error(
-      `Qwen delete chats returned unexpected payload: ${raw.substring(0, 200)}`,
+  // Live mode: fetch remote chats and delete them by ID in parallel batches
+  // (Alibaba WAF rejects bare DELETE /api/v2/chats/ with 401; deleting by ID succeeds 100%).
+  try {
+    const { withAccountPage } = await import("./playwright.ts");
+    const result = await withAccountPage(
+      accountId || "global",
+      async (page) => {
+        return page.evaluate(async () => {
+          let totalDeleted = 0;
+          let pageNum = 1;
+          while (true) {
+            const listRes = await fetch(`/api/v2/chats/?page=${pageNum}&exclude_project=true`, {
+              credentials: "include",
+              headers: { accept: "application/json, text/plain, */*" },
+            });
+            const listJson = await listRes.json().catch(() => null);
+            const items = listJson?.data || [];
+            if (!Array.isArray(items) || items.length === 0) break;
+
+            for (let i = 0; i < items.length; i += 5) {
+              const batch = items.slice(i, i + 5);
+              await Promise.all(
+                batch.map(async (chat: any) => {
+                  try {
+                    await fetch(`/api/v2/chats/${chat.id}`, {
+                      method: "DELETE",
+                      credentials: "include",
+                      headers: { accept: "application/json, text/plain, */*" },
+                    });
+                    totalDeleted++;
+                  } catch {}
+                }),
+              );
+            }
+
+            if (items.length < 20) break;
+          }
+          return { success: true, count: totalDeleted };
+        });
+      },
+      60_000,
+      30_000,
+      true,
     );
-  }
 
-  clearAllSessionsForAccount(accountId || "global");
-  return true;
+    clearAllSessionsForAccount(accountId || "global");
+    return result?.success === true;
+  } catch (err: any) {
+    try {
+      const chats = await fetchRemoteQwenChats(accountId);
+      if (chats.length === 0) {
+        clearAllSessionsForAccount(accountId || "global");
+        return true;
+      }
+      for (const chat of chats) {
+        await deleteSingleQwenChat(accountId, chat.id).catch(() => false);
+      }
+      clearAllSessionsForAccount(accountId || "global");
+      return true;
+    } catch {
+      return false;
+    }
+  }
 }
 
 export interface RemoteQwenChat {

package/src/tools/parser.ts

@@ -412,7 +412,13 @@ function findPartialToolOpenIndexOutsideMarkdownCode(
       if (!tailLower.includes(">")) {
         for (const name of openNames) {
           const full = `<${name.toLowerCase()}`;
-          if (full.startsWith(tailLower)) {
+          if (
+            full.startsWith(tailLower) ||
+            tailLower.startsWith(full + "=") ||
+            tailLower.startsWith(full + " ") ||
+            tailLower.startsWith(full + "\t") ||
+            tailLower.startsWith(full + ":")
+          ) {
             return i;
           }
         }

package/src/tui/app.ts

@@ -7,19 +7,9 @@ import type { TuiView, ProxyStatusSnapshot } from "./types.ts";
 import { theme, glyphs, drawBox, stringWidth } from "./theme.ts";
 import { fetchProxyStatus, fetchLiveModels, getCachedLiveModels } from "./proxy-client.ts";
 import { ServerManager } from "./server-manager.ts";
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { getAppVersion } from "../core/version.ts";
 
-let cachedAppVersion = "";
-try {
-  const currentDir = path.dirname(fileURLToPath(import.meta.url));
-  const pkgPath = path.resolve(currentDir, "../../package.json");
-  if (fs.existsSync(pkgPath)) {
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-    if (pkg.version) cachedAppVersion = `v${pkg.version}`;
-  }
-} catch {}
+const cachedAppVersion = getAppVersion();
 import { StatusView } from "./views/status-view.ts";
 import { ChatView } from "./views/chat-view.ts";
 import { SyncView } from "./views/sync-view.ts";

package/src/tui/server-manager.ts

@@ -247,9 +247,11 @@ export class ServerManager {
 
     // 2. Start in-process
     this.state = "warming";
+    const { getAppVersion } = await import("../core/version.ts");
+    const appVersion = getAppVersion();
     this.appendLog(
       "INFO",
-      `🚀 [Server] Iniciando servidor na porta ${port}...`,
+      `🚀 [Server] Iniciando QwenProxy ${appVersion} na porta ${port}...`,
     );
 
     this.interceptLogs();