qwenproxy-cli 1.4.0 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {
@@ -32,6 +32,8 @@
     "test:mock": "tsx --test --test-concurrency=1 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/auth-session-persistence.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts src/tests/auth-jwt-and-validation.test.ts src/tests/tui-port-and-key-modal.test.ts",
     "test:mock:fast": "tsx --test --test-concurrency=2 --env-file=.env.test src/tests/account-concurrency.test.ts src/tests/concurrency-latest-wins.test.ts src/tests/mutex.test.ts src/tests/context-truncation.test.ts src/tests/streaming-thinking-summary.test.ts src/tests/tool-call-guard.test.ts src/tests/utils-logger-full.test.ts src/tests/logger-toolcall-errors.test.ts src/tests/logger-toolcall-disabled.test.ts src/tests/utils-json-full.test.ts src/tests/utils-session-guard-full.test.ts src/tests/core-logic-full.test.ts src/tests/core-logic-accounts.test.ts src/tests/chat-validation-full.test.ts src/tests/chat-logic-full.test.ts src/tests/account-stickiness.test.ts src/tests/accounts-security.test.ts src/tests/advanced.test.ts src/tests/auth-playwright.test.ts src/tests/auth-session-persistence.test.ts src/tests/captcha-solver.test.ts src/tests/cache-scan-regex.test.ts src/tests/chat-cleanup.test.ts src/tests/chat-cleanup-auto.test.ts src/tests/chromium-args.test.ts src/tests/config-current.test.ts src/tests/context-meter.test.ts src/tests/concurrency.test.ts src/tests/delta.test.ts src/tests/fingerprint.test.ts src/tests/human-behavior.test.ts src/tests/index.test.ts src/tests/json-recovery.test.ts src/tests/jsonFix.test.ts src/tests/memory-cache.test.ts src/tests/model-alias.test.ts src/tests/model-registry-thinking.test.ts src/tests/models-endpoint.test.ts src/tests/multimodal.test.ts src/tests/oss-upload.test.ts src/tests/parser.test.ts src/tests/personalization-flow.test.ts src/tests/personalization-required.test.ts src/tests/retry-policy.test.ts src/tests/rotation.test.ts src/tests/server-lifecycle.test.ts src/tests/session-keeper.test.ts src/tests/session-state.test.ts src/tests/single-account-mode.test.ts src/tests/stream-retry.test.ts src/tests/tool-calls-endpoint.test.ts src/tests/tool-instructions-cache.test.ts src/tests/session-id.test.ts src/tests/watchdog-ram.test.ts src/tests/tool-recovery-t1t2.test.ts src/tests/abort-silent-t4.test.ts src/tests/t3-close-tag-escape.test.ts src/tests/t5-tool-cap.test.ts src/tests/logger-redaction.test.ts src/tests/stall-timeout-retryable.test.ts src/tests/t6-missing-quote-array-close.test.ts src/tests/watchdog-rss.test.ts src/tests/logical-thread-batch.test.ts src/tests/chat-pool-style.test.ts src/tests/queue-wait-cap.test.ts src/tests/context-eviction-order.test.ts src/tests/chat-in-progress-settle.test.ts src/tests/stream-lock-leak.test.ts src/tests/stream-semaphore.test.ts src/tests/waf-isolation.test.ts src/tests/legacy-completions.test.ts src/tests/response-format.test.ts src/tests/cors-headers.test.ts src/tests/local-auth.test.ts src/tests/safe-remote-url.test.ts src/tests/stream-lock-terminal-cancel.test.ts src/tests/parser-truncated-tool-call.test.ts src/tests/metrics-prometheus.test.ts src/tests/context-death-cleanup.test.ts src/tests/personalization-direct-fetch.test.ts src/tests/completion-headers-parity.test.ts src/tests/parallel-escape-repro.test.ts src/tests/chat-in-progress-scale-cost.test.ts src/tests/temp-chat-mode.test.ts src/tests/profile-reset.test.ts src/tests/error-classification.test.ts src/tests/quota-cooldown.test.ts src/tests/account-ready-gate.test.ts src/tests/tool-cap-notice.test.ts src/tests/interaction-flows.test.ts src/tests/headers-gate-cooldown-fallback.test.ts src/tests/unwrapped-tool-calls.test.ts src/tests/anthropic.test.ts src/tests/sync-clients.test.ts src/tests/sync-top10-clients.test.ts src/tests/cli.test.ts src/tests/paths.test.ts src/tests/tool-manifest.test.ts src/tests/tui.test.ts src/tests/tui-settings.test.ts src/tests/personalization-deadline.test.ts src/tests/update-cli.test.ts src/tests/batch-accounts.test.ts src/tests/shared-browser.test.ts src/tests/auth-credential-classification.test.ts src/tests/responses-api.test.ts src/tests/media-generation.test.ts src/tests/infer-tool-name.test.ts src/tests/native-session-headers.test.ts src/tests/omni-thinking.test.ts src/tests/protect-stuck-mutex.test.ts src/tests/stream-error-notice.test.ts src/tests/parser-deep-coverage.test.ts src/tests/tui-logs-copy.test.ts src/tests/auth-jwt-and-validation.test.ts src/tests/tui-port-and-key-modal.test.ts",
     "test:live": "tsx --test src/tests/concurrentChat.test.ts src/tests/agenticStress.test.ts",
+    "test:stress": "npx tsx src/benchmarks/stress-test.ts",
+    "test:stress:personalization": "npx tsx src/benchmarks/stress-test-personalization.ts",
     "benchmark:proxy": "npx tsx src/benchmarks/proxy-baseline.ts",
     "typecheck": "tsc --noEmit"
   },
@@ -62,16 +64,16 @@
     "@hono/node-server": "^2.1.1",
     "ali-oss": "^6.23.0",
     "better-sqlite3": "^13.0.3",
-    "dotenv": "^17.4.2",
-    "hono": "^4.13.7",
+    "dotenv": "^18.0.4",
+    "hono": "^4.13.9",
     "patchright": "1.63.0",
-    "tsx": "^4.23.13",
+    "tsx": "^4.23.15",
     "uuid": "^14.0.2",
-    "zod": "^4.5.4"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.3",
     "esbuild": "^0.28.2",
     "typescript": "^7.0.2"
   },

package/src/core/config.ts

@@ -1,4 +1,17 @@
+import fs from "node:fs";
+import dotenv from "dotenv";
 import { z } from "zod";
+import { getEnvFilePath, isRunningUnderNodeTest } from "./paths.ts";
+
+// Ensure .env is loaded before parsing schema across CLI, TUI, and server modes
+if (!isRunningUnderNodeTest()) {
+  const envPath = getEnvFilePath();
+  if (fs.existsSync(envPath)) {
+    dotenv.config({ path: envPath, quiet: true });
+  } else {
+    dotenv.config({ quiet: true });
+  }
+}
 
 const envSchema = z
   .object({

package/src/core/version.ts

@@ -17,6 +17,6 @@ export function getAppVersion(): string {
       }
     }
   } catch {}
-  cachedVersion = "v1.4.0";
+  cachedVersion = "v1.4.2";
   return cachedVersion;
 }

package/src/routes/chat/index.ts

@@ -279,6 +279,7 @@ export async function chatCompletions(c: Context) {
     )) {
       c.header(name, value);
     }
+    c.header("X-QwenProxy-Account", streamResult.activeAccountLabel);
 
     // A full-context replay (account switch / missing thread parent) hides its
     // real cost behind the thread-native delta numbers: surface it explicitly

package/src/services/playwright.ts

@@ -450,7 +450,7 @@ export async function isPageLoggedIn(
 
 export async function getOrLaunchSharedBrowser(
   browserType: BrowserType = "chromium",
-  headless = true,
+  headless = config.playwright.headless,
 ): Promise<Browser> {
   if (sharedBrowser && sharedBrowser.isConnected()) {
     return sharedBrowser;
@@ -587,15 +587,42 @@ const CHAT_INPUT_ACTION_TIMEOUT_MS = 10_000;
  * account for five minutes.
  */
 async function clearVisibleChallenge(page: Page): Promise<void> {
-  if (!config.captcha.enabled) return;
-  // waitForMs 0: a single detection pass, so the common no-challenge case adds
-  // no measurable cost to header capture.
-  await solveBaxiaCaptcha(page, {
-    waitForMs: 0,
-    maxAttempts: config.captcha.maxAttempts,
-    retryDelayMs: config.captcha.retryDelayMs,
-    settleMs: config.captcha.settleMs,
-  }).catch(() => false);
+  if (page.isClosed()) return;
+  // 1. Solve slider puzzle captcha if present
+  if (config.captcha.enabled) {
+    await solveBaxiaCaptcha(page, {
+      waitForMs: 0,
+      maxAttempts: config.captcha.maxAttempts,
+      retryDelayMs: config.captcha.retryDelayMs,
+      settleMs: config.captcha.settleMs,
+    }).catch(() => false);
+  }
+
+  // 2. Dismiss any overlay modals (Welcome to Qwen, Terms/Consent, Whats New, etc.)
+  // that can block the chat textarea or send button
+  try {
+    const modalCloseSelectors = [
+      ".ant-modal-close",
+      ".ant-modal-close-x",
+      "button.ant-modal-close",
+      "button[aria-label*='Close' i]",
+      "button[aria-label*='Fechar' i]",
+      ".index-module__whats-new-modal-close",
+      "button:has-text('Cancel')",
+      "button:has-text('Cancelar')",
+      "button:has-text('I understand')",
+      "button:has-text('Entendi')",
+      "button:has-text('OK')",
+    ];
+    for (const sel of modalCloseSelectors) {
+      if (page.isClosed()) return;
+      const btn = page.locator(sel).first();
+      if (await btn.isVisible({ timeout: 150 }).catch(() => false)) {
+        await btn.click({ timeout: 500 }).catch(() => {});
+        await sleep(200);
+      }
+    }
+  } catch {}
 }
 
 function getErrorMessage(error: unknown): string {
@@ -1051,6 +1078,21 @@ export function getStealthScript(profile: FingerprintProfile): string {
           spoofedFunctions.add(window.performance.getEntriesByType);
         }
       } catch(e) {}
+
+      // --- Auto-resolve birthday compliance & eliminate false logout markers ---
+      try {
+        localStorage.removeItem("qwen_token_logged_out_marker");
+        const b = localStorage.getItem("qwen_account_birthday");
+        if (b) {
+          try {
+            const parsed = JSON.parse(b);
+            if (!parsed.birthday) {
+              parsed.birthday = "1995-06-15";
+              localStorage.setItem("qwen_account_birthday", JSON.stringify(parsed));
+            }
+          } catch {}
+        }
+      } catch(e) {}
     })();
   `;
 }
@@ -1443,7 +1485,7 @@ async function resolveAccountCredentials(account: QwenAccount): Promise<QwenAcco
 
 export async function initPlaywrightForAccount(
   rawAccount: QwenAccount,
-  headless = true,
+  headless = config.playwright.headless,
   browserType: BrowserType = "chromium",
   options: { skipHeaderCapture?: boolean } = {},
 ): Promise<void> {
@@ -1695,10 +1737,19 @@ export async function initPlaywrightForAccount(
 
       if (restoredFromDb) {
         if (!acctPage.isClosed() && (acctPage.url() === "about:blank" || !acctPage.url().startsWith(qwenOrigin()))) {
-          void acctPage.goto(qwenUrl("/"), {
-            waitUntil: "domcontentloaded",
-            timeout: config.timeouts.navigation,
-          }).catch(() => {});
+          try {
+            await acctPage.goto(qwenUrl("/"), {
+              waitUntil: "domcontentloaded",
+              timeout: config.timeouts.navigation,
+            });
+            await sleep(300);
+          } catch (err: any) {
+            if (!err?.message?.includes("ERR_ABORTED")) {
+              console.warn(
+                `⚠️  [Playwright] Background navigation warning for ${maskEmail(account.email)}: ${err.message}`,
+              );
+            }
+          }
         }
         return;
       }
@@ -2022,17 +2073,33 @@ async function loginToQwen(
     const apiResult = await loginViaApi(page, email, password);
     if (apiResult.success) {
       cookieCaches.delete(accountId);
-      const cache = headerCaches.get(accountId);
-      if (cache) {
-        cache.headers = {};
-        cache.lastRefresh = 0;
-      }
-      unmarkAccountHeadersReady(accountId);
+      await saveStorageState(page.context(), accountId);
       try {
-        const { deleteAuthSession } = await import("../core/database.ts");
-        deleteAuthSession(accountId);
+        const liveCookies = await page.context().cookies();
+        const tokenCookie = liveCookies.find((c) => c.name === "token");
+        if (tokenCookie) {
+          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+          const cache = getHeaderCache(accountId);
+          cache.headers.cookie = cookieStr;
+          cache.lastRefresh = Date.now();
+          markAccountHeadersReady(accountId);
+          const { saveAuthSession } = await import("../core/database.ts");
+          const exp = parseJwtExpiry(tokenCookie.value);
+          saveAuthSession(accountId, {
+            cookie: cookieStr,
+            userAgent: cache.headers["user-agent"] || "",
+            bxV: cache.headers["bx-v"] || "2.5.37",
+            bxUa: cache.headers["bx-ua"] || "",
+            bxUmidtoken: cache.headers["bx-umidtoken"] || "",
+            secChUa: cache.headers["sec-ch-ua"] || undefined,
+            secChUaMobile: cache.headers["sec-ch-ua-mobile"] || undefined,
+            secChUaPlatform: cache.headers["sec-ch-ua-platform"] || undefined,
+            version: cache.headers["version"] || undefined,
+            tokenExpiresAt: exp || undefined,
+            capturedAt: Date.now(),
+          });
+        }
       } catch {}
-      await saveStorageState(page.context(), accountId);
       return true;
     }
 
@@ -2052,17 +2119,33 @@ async function loginToQwen(
     const uiResult = await loginViaUi(page, email, password);
     if (uiResult.success) {
       cookieCaches.delete(accountId);
-      const cache = headerCaches.get(accountId);
-      if (cache) {
-        cache.headers = {};
-        cache.lastRefresh = 0;
-      }
-      unmarkAccountHeadersReady(accountId);
+      await saveStorageState(page.context(), accountId);
       try {
-        const { deleteAuthSession } = await import("../core/database.ts");
-        deleteAuthSession(accountId);
+        const liveCookies = await page.context().cookies();
+        const tokenCookie = liveCookies.find((c) => c.name === "token");
+        if (tokenCookie) {
+          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+          const cache = getHeaderCache(accountId);
+          cache.headers.cookie = cookieStr;
+          cache.lastRefresh = Date.now();
+          markAccountHeadersReady(accountId);
+          const { saveAuthSession } = await import("../core/database.ts");
+          const exp = parseJwtExpiry(tokenCookie.value);
+          saveAuthSession(accountId, {
+            cookie: cookieStr,
+            userAgent: cache.headers["user-agent"] || "",
+            bxV: cache.headers["bx-v"] || "2.5.37",
+            bxUa: cache.headers["bx-ua"] || "",
+            bxUmidtoken: cache.headers["bx-umidtoken"] || "",
+            secChUa: cache.headers["sec-ch-ua"] || undefined,
+            secChUaMobile: cache.headers["sec-ch-ua-mobile"] || undefined,
+            secChUaPlatform: cache.headers["sec-ch-ua-platform"] || undefined,
+            version: cache.headers["version"] || undefined,
+            tokenExpiresAt: exp || undefined,
+            capturedAt: Date.now(),
+          });
+        }
       } catch {}
-      await saveStorageState(page.context(), accountId);
       return true;
     }
 
@@ -2292,11 +2375,22 @@ async function loginViaUi(
     }
 
     // In Qwen Web, if the page opens on the default email OTP panel, click "Log in with a password"
-    // to reveal the standard email + password form.
+    // (supporting English, Portuguese, Spanish, Chinese) to reveal the standard email + password form.
+    await clearVisibleChallenge(page);
+
+    const findPasswordModeButton = () => {
+      return page
+        .locator('button, [role="button"], a, div')
+        .filter({
+          hasText: /(?:log\s*in\s*with\s*(?:a\s*)?password|fazer\s*login\s*com\s*senha|entrar\s*com\s*(?:uma\s*)?senha|iniciar\s*sesi[oó]n\s*con\s*contrase[nñ]a|密码登录)/i,
+        })
+        .first();
+    };
+
     try {
-      const pwdModeBtn = page.getByText(/Log in with a password/i).first();
-      if (await pwdModeBtn.isVisible({ timeout: 1500 }).catch(() => false)) {
-        await pwdModeBtn.click().catch(() => {});
+      const pwdModeBtn = findPasswordModeButton();
+      if (await pwdModeBtn.isVisible({ timeout: 2000 }).catch(() => false)) {
+        await pwdModeBtn.click({ timeout: 2000 }).catch(() => {});
         await sleep(500);
       }
     } catch {}
@@ -2307,9 +2401,9 @@ async function loginViaUi(
 
     // If "Log in with a password" button appeared after typing email, click it
     try {
-      const pwdModeBtn = page.getByText(/Log in with a password/i).first();
-      if (await pwdModeBtn.isVisible({ timeout: 1000 }).catch(() => false)) {
-        await pwdModeBtn.click().catch(() => {});
+      const pwdModeBtn = findPasswordModeButton();
+      if (await pwdModeBtn.isVisible({ timeout: 1500 }).catch(() => false)) {
+        await pwdModeBtn.click({ timeout: 2000 }).catch(() => {});
         await sleep(500);
       }
     } catch {}
@@ -2343,7 +2437,7 @@ async function loginViaUi(
     // Prefer clicking the submit button; fall back to pressing Enter.
     // The button starts disabled and only enables once both fields are filled.
     const submitSelector =
-      'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in")';
+      'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in"), button:has-text("Fazer login"), button:has-text("Entrar"), button:has-text("Iniciar sesión"), button:has-text("登录")';
     const submitButton = page.locator(submitSelector).first();
     try {
       await page.waitForSelector('button[type="submit"]:not([disabled])', {
@@ -3164,9 +3258,9 @@ async function refreshHeadersInternal(
         }
       }
 
-      // Fast re-auth completion: if re-auth succeeded and required anti-bot tokens are already cached,
+      // Fast refresh completion: if required anti-bot tokens are already cached,
       // refresh cookies directly without running slow UI typing interception.
-      if (reauthExecuted && hasRequiredQwenHeaders(cache.headers)) {
+      if (hasRequiredQwenHeaders(cache.headers)) {
         const liveCookies = await page.context().cookies();
         if (liveCookies.some((c) => c.name === "token")) {
           const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");

package/src/services/qwen.ts

@@ -800,10 +800,19 @@ async function withQwenBrowserPage<T>(
         (normalizedTargetPath !== null && currentPath !== normalizedTargetPath);
 
       if (needsNavigation) {
-        await page.goto(targetUrl, {
-          waitUntil: "domcontentloaded",
-          timeout: Math.min(config.timeouts.navigation, operationTimeoutMs),
-        });
+        try {
+          await page.goto(targetUrl, {
+            waitUntil: "domcontentloaded",
+            timeout: Math.min(config.timeouts.navigation, operationTimeoutMs),
+          });
+        } catch (err: any) {
+          // If navigation was aborted because page reached target origin or redirect finished, ignore benign abort
+          if (err?.message?.includes("ERR_ABORTED") && page.url().startsWith(targetOrigin)) {
+            // benign navigation interruption
+          } else {
+            throw err;
+          }
+        }
       }
 
       return fn(page);
@@ -908,7 +917,7 @@ export async function requestQwenTextInBrowser(
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
         try {
-          const response = await fetch(url, {
+          let response = await fetch(url, {
             method,
             credentials: "include",
             headers,
@@ -916,6 +925,38 @@ export async function requestQwenTextInBrowser(
             signal: controller.signal,
             ...(referrer ? { referrer } : {}),
           });
+
+          // If 401 Unauthorized in browser, try silent in-page token refresh before giving up
+          if (response.status === 401) {
+            try {
+              const refreshRes = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+                method: "GET",
+                credentials: "include",
+                signal: AbortSignal.timeout(3000),
+              });
+              if (refreshRes.status === 200) {
+                const refreshJson: any = await refreshRes.json().catch(() => null);
+                if (refreshJson && refreshJson.success === true && refreshJson.data?.token) {
+                  const freshTok = refreshJson.data.token;
+                  localStorage.setItem("token", freshTok);
+                  document.cookie = `token=${encodeURIComponent(freshTok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+                  if (headers["authorization"] || headers["Authorization"]) {
+                    headers["authorization"] = `Bearer ${freshTok}`;
+                    headers["Authorization"] = `Bearer ${freshTok}`;
+                  }
+                  response = await fetch(url, {
+                    method,
+                    credentials: "include",
+                    headers,
+                    body,
+                    signal: controller.signal,
+                    ...(referrer ? { referrer } : {}),
+                  });
+                }
+              }
+            } catch {}
+          }
+
           return {
             status: response.status,
             contentType: response.headers.get("content-type") || "",
@@ -1059,20 +1100,7 @@ async function requestQwenPersonalizationInBrowser(
   headers: Record<string, string>,
   payload?: Record<string, unknown>,
 ): Promise<{ status: number; raw: string; json: any }> {
-  // If browser-only fetch is disabled, try direct Node fetch as fast-path
-  if (!config.qwen.browserOnlyFetch && !isAuthMockEnabled()) {
-    const direct = await requestQwenSettingsDirectFetch(
-      accountId,
-      method,
-      path,
-      headers,
-      payload,
-    );
-    if (direct) {
-      return direct;
-    }
-  }
-
+  // Always route personalization through stealth browser page (user constraint: tudo via browser stealth)
   const response = await requestQwenTextInBrowser(
     accountId,
     method,