qwenproxy-cli 1.4.3 → 1.4.8

package/dist/index.js

@@ -1608,6 +1608,7 @@ function runMigrations(db2) {
     "sec_ch_ua_mobile TEXT",
     "sec_ch_ua_platform TEXT",
     "version TEXT",
+    "refresh_token TEXT",
     "captured_at INTEGER DEFAULT 0"
   ];
   for (const col of authSessionCols) {
@@ -1686,11 +1687,11 @@ function saveAuthSession(accountId, session) {
     INSERT OR REPLACE INTO qwen_auth_sessions (
       account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
       sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-      user_id, token_expires_at, captured_at, updated_at
+      user_id, token_expires_at, refresh_token, captured_at, updated_at
     ) VALUES (
       ?, ?, ?, ?, ?, ?,
       ?, ?, ?, ?,
-      ?, ?, ?, datetime('now')
+      ?, ?, ?, ?, datetime('now')
     )
   `);
   stmt.run(
@@ -1706,6 +1707,7 @@ function saveAuthSession(accountId, session) {
     session.version || null,
     session.userId || null,
     session.tokenExpiresAt || null,
+    session.refreshToken || null,
     session.capturedAt ?? Date.now()
   );
 }
@@ -1714,7 +1716,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
   const row = database.prepare(
     `SELECT account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
               sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-              user_id, token_expires_at, captured_at
+              user_id, token_expires_at, refresh_token, captured_at
        FROM qwen_auth_sessions WHERE account_id = ?`
   ).get(accountId);
   if (!row) return null;
@@ -1722,7 +1724,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
   if (capturedAt <= 0 || Date.now() - capturedAt > maxAgeMs) {
     return null;
   }
-  if (row.token_expires_at) {
+  if (!row.refresh_token && row.token_expires_at) {
     const tokenExpMs = Number(row.token_expires_at) * 1e3;
     if (tokenExpMs <= Date.now() + 5 * 60 * 1e3) {
       return null;
@@ -1744,6 +1746,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
     version: row.version || void 0,
     userId: row.user_id || void 0,
     tokenExpiresAt: row.token_expires_at ? Number(row.token_expires_at) : void 0,
+    refreshToken: row.refresh_token || void 0,
     capturedAt
   };
 }
@@ -4269,6 +4272,7 @@ __export(playwright_exports, {
   parseCookiesForBrowser: () => parseCookiesForBrowser,
   pruneAllPlaywrightProfiles: () => pruneAllPlaywrightProfiles,
   prunePlaywrightProfileCaches: () => prunePlaywrightProfileCaches,
+  refreshAccountToken: () => refreshAccountToken,
   refreshHeaders: () => refreshHeaders,
   refreshHeadersWithProfileReset: () => refreshHeadersWithProfileReset,
   registerPlaywrightAccountForTests: () => registerPlaywrightAccountForTests,
@@ -4996,8 +5000,29 @@ function getStealthScript(profile) {
         const _toBlob = HTMLCanvasElement.prototype.toBlob;
         const _getImageData = CanvasRenderingContext2D.prototype.getImageData;
 
+        function isCaptchaCanvas(canvas) {
+          try {
+            if (!canvas) return false;
+            const id = (canvas.id || "").toLowerCase();
+            const cls = (canvas.className || "").toLowerCase();
+            return (
+              id.includes("baxia") ||
+              id.includes("nc_") ||
+              id.includes("captcha") ||
+              id.includes("punish") ||
+              cls.includes("baxia") ||
+              cls.includes("nc_") ||
+              cls.includes("captcha") ||
+              Boolean(canvas.closest?.("#baxia-dialog, #baxia-punish, [class*='baxia'], [class*='nc_'], .auth-layout"))
+            );
+          } catch(e) {
+            return false;
+          }
+        }
+
         function addNoise(canvas) {
           try {
+            if (isCaptchaCanvas(canvas)) return;
             const ctx = canvas.getContext('2d');
             if (!ctx) return;
             const style = ctx.fillStyle;
@@ -5021,6 +5046,9 @@ function getStealthScript(profile) {
 
         CanvasRenderingContext2D.prototype.getImageData = function(x, y, w, h) {
           const imageData = _getImageData.apply(this, arguments);
+          if (isCaptchaCanvas(this.canvas)) {
+            return imageData;
+          }
           const data = imageData.data;
           const maxPixels = Math.min(data.length / 4, 2500);
           for (let i = 0; i < maxPixels * 4; i += 4) {
@@ -5880,6 +5908,7 @@ async function loginToQwen(accountId, email, password) {
             secChUaPlatform: cache3.headers["sec-ch-ua-platform"] || void 0,
             version: cache3.headers["version"] || void 0,
             tokenExpiresAt: exp || void 0,
+            refreshToken: apiResult.refreshToken,
             capturedAt: Date.now()
           });
         }
@@ -5913,6 +5942,13 @@ async function loginToQwen(accountId, email, password) {
           markAccountHeadersReady(accountId);
           const { saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
           const exp = parseJwtExpiry(tokenCookie.value);
+          let rTok = uiResult.refreshToken;
+          if (!rTok) {
+            try {
+              rTok = await page.evaluate(() => localStorage.getItem("refresh_token") || "") || void 0;
+            } catch {
+            }
+          }
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || "",
@@ -5924,6 +5960,7 @@ async function loginToQwen(accountId, email, password) {
             secChUaPlatform: cache3.headers["sec-ch-ua-platform"] || void 0,
             version: cache3.headers["version"] || void 0,
             tokenExpiresAt: exp || void 0,
+            refreshToken: rTok,
             capturedAt: Date.now()
           });
         }
@@ -5976,37 +6013,52 @@ async function loginToQwen(accountId, email, password) {
 async function loginViaApi(page, email, password) {
   try {
     const hashedPassword = crypto5.createHash("sha256").update(password).digest("hex");
-    const signinUrl = qwenUrl("/api/v2/auths/signin");
-    let signinSuccess = false;
-    let data = null;
-    if (page.request && typeof page.request.post === "function") {
-      try {
-        const response = await page.request.post(signinUrl, {
-          data: {
-            email,
-            password: hashedPassword,
-            login_type: "email"
-          },
-          headers: {
-            "content-type": "application/json",
-            accept: "application/json, text/plain, */*",
-            referer: qwenUrl("/auth"),
-            origin: qwenOrigin(),
-            source: "web"
-          },
-          timeout: 1e4
-        });
-        data = await response.json().catch(() => null);
-        signinSuccess = Boolean(data && (data.success === true || data.token));
-      } catch {
-      }
+    if (!page.url().includes("/auth")) {
+      await page.goto(qwenUrl("/auth"), {
+        waitUntil: "domcontentloaded",
+        timeout: config.timeouts.navigation
+      }).catch(() => {
+      });
+      await sleep2(1e3);
     }
-    if (!signinSuccess && !data) {
-      const requestId = crypto5.randomUUID();
-      const evalRes = await page.evaluate(
-        async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2 }) => {
+    const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
+    const requestId = crypto5.randomUUID();
+    const evalRes = await page.evaluate(
+      async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2 }) => {
+        try {
+          const response = await fetch(signinUrl2, {
+            method: "POST",
+            signal: AbortSignal.timeout(15e3),
+            credentials: "include",
+            headers: {
+              accept: "application/json, text/plain, */*",
+              "content-type": "application/json",
+              source: "web",
+              version: "0.3.11",
+              "x-request-origin": "https://chat.qwen.ai",
+              timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0],
+              "x-request-id": requestId2
+            },
+            body: JSON.stringify({ email: email2, password: password2 })
+          });
+          const json = await response.json().catch(() => null);
+          return { ok: response.ok, status: response.status, data: json };
+        } catch (e) {
+          return { ok: false, error: e.message };
+        }
+      },
+      { email, password: hashedPassword, signinUrl, requestId }
+    ).catch(() => null);
+    let data = evalRes?.data;
+    let signinSuccess = Boolean(
+      data && (data.success === true || data.token || data.data?.access_token || data.data?.token)
+    );
+    if (!signinSuccess && !data?.data?.code) {
+      const fallbackUrl = qwenUrl("/api/v2/auths/signin");
+      const fallbackRes = await page.evaluate(
+        async ({ email: email2, password: password2, fallbackUrl: fallbackUrl2, requestId: requestId2 }) => {
           try {
-            const response = await fetch(signinUrl2, {
+            const response = await fetch(fallbackUrl2, {
               method: "POST",
               signal: AbortSignal.timeout(1e4),
               credentials: "include",
@@ -6014,10 +6066,11 @@ async function loginViaApi(page, email, password) {
                 accept: "application/json, text/plain, */*",
                 "content-type": "application/json",
                 source: "web",
+                version: "0.3.11",
                 timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0],
                 "x-request-id": requestId2
               },
-              body: JSON.stringify({ email: email2, password: password2, login_type: "email" })
+              body: JSON.stringify({ email: email2, password: password2 })
             });
             const json = await response.json().catch(() => null);
             return { ok: response.ok, status: response.status, data: json };
@@ -6025,11 +6078,13 @@ async function loginViaApi(page, email, password) {
             return { ok: false, error: e.message };
           }
         },
-        { email, password: hashedPassword, signinUrl, requestId }
+        { email, password: hashedPassword, fallbackUrl, requestId }
       ).catch(() => null);
-      if (evalRes?.data) {
-        data = evalRes.data;
-        signinSuccess = Boolean(data && (data.success === true || data.token));
+      if (fallbackRes?.data) {
+        data = fallbackRes.data;
+        signinSuccess = Boolean(
+          data && (data.success === true || data.token || data.data?.access_token || data.data?.token)
+        );
       }
     }
     if (data?.success === false) {
@@ -6043,7 +6098,8 @@ async function loginViaApi(page, email, password) {
       };
     }
     if (signinSuccess) {
-      const token = data?.data?.token || data?.token;
+      const token = data?.data?.access_token || data?.data?.token || data?.access_token || data?.token;
+      const refreshToken = data?.data?.refresh_token || data?.refresh_token;
       if (token) {
         try {
           await page.context().addCookies([
@@ -6067,18 +6123,23 @@ async function loginViaApi(page, email, password) {
       }).catch(() => {
       });
       if (token) {
-        await page.evaluate((tok) => {
-          try {
-            localStorage.removeItem("qwen_token_logged_out_marker");
-            localStorage.setItem("token", tok);
-            document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
-          } catch {
-          }
-        }, token).catch(() => {
+        await page.evaluate(
+          ({ tok, rTok }) => {
+            try {
+              localStorage.removeItem("qwen_token_logged_out_marker");
+              localStorage.setItem("token", tok);
+              localStorage.setItem("access_token", tok);
+              if (rTok) localStorage.setItem("refresh_token", rTok);
+              document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+            } catch {
+            }
+          },
+          { tok: token, rTok: refreshToken }
+        ).catch(() => {
         });
         await page.reload({ waitUntil: "domcontentloaded" }).catch(() => {
         });
-        return { success: true };
+        return { success: true, token, refreshToken };
       }
     }
     return {
@@ -6102,11 +6163,23 @@ async function loginViaApi(page, email, password) {
 }
 async function loginViaUi(page, email, password) {
   try {
-    await page.goto(qwenUrl("/auth"), {
-      waitUntil: "domcontentloaded",
-      timeout: config.timeouts.navigation
-    });
-    await sleep2(1500);
+    if (!page.url().includes("/auth") && await isPageLoggedIn(page, 2e3).catch(() => false)) {
+      return { success: true };
+    }
+    try {
+      await page.goto(qwenUrl("/auth"), {
+        waitUntil: "domcontentloaded",
+        timeout: Math.min(config.timeouts.navigation, 15e3)
+      });
+      await sleep2(1e3);
+    } catch (gotoErr) {
+      if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3).catch(() => false)) {
+        return { success: true };
+      }
+    }
+    if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3).catch(() => false)) {
+      return { success: true };
+    }
     const emailSelector = [
       'input[type="email"]',
       'input[name="email"]',
@@ -6116,7 +6189,7 @@ async function loginViaUi(page, email, password) {
     ].join(", ");
     try {
       await page.waitForSelector(emailSelector, {
-        timeout: Math.min(config.timeouts.page, 8e3)
+        timeout: Math.min(config.timeouts.page, 5e3)
       });
     } catch {
       if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3)) {
@@ -6129,30 +6202,55 @@ async function loginViaUi(page, email, password) {
       return { success: false, reason: "Campo de e-mail n\xE3o encontrado (poss\xEDvel captcha)" };
     }
     await clearVisibleChallenge(page);
-    const findPasswordModeButton = () => {
-      return page.locator('button, [role="button"], a, div').filter({
-        hasText: /(?:log\s*in\s*with\s*(?:a\s*)?password|fazer\s*login\s*com\s*senha|entrar\s*com\s*(?:uma\s*)?senha|iniciar\s*sesi[oó]n\s*con\s*contrase[nñ]a|密码登录)/i
-      }).first();
+    const isPasswordInputPresent = async () => {
+      return await page.locator('input[type="password"], input[name="password"]').count().catch(() => 0) > 0;
     };
-    try {
-      const pwdModeBtn = findPasswordModeButton();
-      if (await pwdModeBtn.isVisible({ timeout: 2e3 }).catch(() => false)) {
-        await pwdModeBtn.click({ timeout: 2e3 }).catch(() => {
+    const revealPasswordMode = async () => {
+      if (page.url().includes("/forget")) {
+        await page.goto(qwenUrl("/auth"), { waitUntil: "domcontentloaded", timeout: 1e4 }).catch(() => {
         });
-        await sleep2(500);
+        await sleep2(1e3);
       }
-    } catch {
-    }
-    await page.fill(emailSelector, email);
-    await sleep2(300);
-    try {
-      const pwdModeBtn = findPasswordModeButton();
-      if (await pwdModeBtn.isVisible({ timeout: 1500 }).catch(() => false)) {
-        await pwdModeBtn.click({ timeout: 2e3 }).catch(() => {
+      if (await isPasswordInputPresent()) return;
+      const btn = page.locator("button").filter({
+        hasText: /(?:log\s*in\s*with\s*(?:a\s*)?password|fazer\s*login\s*com\s*senha|entrar\s*com\s*(?:uma\s*)?senha|iniciar\s*sesi[oó]n\s*con\s*contrase[nñ]a|密码登录)/i
+      }).filter({
+        hasNotText: /(?:esqueci|forgot|olvid|reset|recover)/i
+      }).first();
+      if (await btn.isVisible({ timeout: 1500 }).catch(() => false)) {
+        await btn.click({ timeout: 2e3 }).catch(() => {
         });
         await sleep2(500);
       }
+      if (await isPasswordInputPresent()) return;
+      await page.evaluate(() => {
+        try {
+          const buttons = Array.from(document.querySelectorAll("button, [role='button'], a"));
+          for (const b of buttons) {
+            const txt = (b.innerText || "").trim().toLowerCase();
+            if (/(?:log\s*in\s*with\s*(?:a\s*)?password|fazer\s*login\s*com\s*senha|entrar\s*com\s*(?:uma\s*)?senha|iniciar\s*sesi[oó]n\s*con\s*contrase[nñ]a|密码登录)/i.test(txt) && !txt.includes("esqueci") && !txt.includes("forgot") && !txt.includes("olvid") && !txt.includes("reset")) {
+              b.click();
+              return true;
+            }
+          }
+        } catch {
+        }
+        return false;
+      }).catch(() => false);
+      await sleep2(500);
+    };
+    await revealPasswordMode();
+    try {
+      await page.fill(emailSelector, email, { timeout: 8e3 });
+      await sleep2(300);
     } catch {
+      if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3)) {
+        return { success: true };
+      }
+      throw new Error(`Campo de e-mail n\xE3o encontrado na tela de autentica\xE7\xE3o`);
+    }
+    if (!await isPasswordInputPresent()) {
+      await revealPasswordMode();
     }
     const passwordSelector = 'input[type="password"], input[name="password"]';
     try {
@@ -6171,17 +6269,50 @@ async function loginViaUi(page, email, password) {
         reason: "Campo de senha n\xE3o encontrado na tela de autentica\xE7\xE3o"
       };
     }
-    await page.fill(passwordSelector, password);
-    await sleep2(500);
+    try {
+      await page.fill(passwordSelector, password, { timeout: 8e3 });
+      await sleep2(500);
+    } catch {
+      if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3)) {
+        return { success: true };
+      }
+      throw new Error(`Campo de senha n\xE3o encontrado na tela de autentica\xE7\xE3o`);
+    }
+    await page.evaluate(() => {
+      try {
+        const emailEl = document.querySelector('input[name="email"], input[type="email"], input[type="text"]');
+        const passEl = document.querySelector('input[type="password"], input[name="password"]');
+        if (emailEl) {
+          emailEl.dispatchEvent(new Event("input", { bubbles: true }));
+          emailEl.dispatchEvent(new Event("change", { bubbles: true }));
+          emailEl.dispatchEvent(new Event("blur", { bubbles: true }));
+        }
+        if (passEl) {
+          passEl.dispatchEvent(new Event("input", { bubbles: true }));
+          passEl.dispatchEvent(new Event("change", { bubbles: true }));
+          passEl.dispatchEvent(new Event("blur", { bubbles: true }));
+        }
+      } catch {
+      }
+    }).catch(() => {
+    });
     const submitSelector = 'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in"), button:has-text("Fazer login"), button:has-text("Entrar"), button:has-text("Iniciar sesi\xF3n"), button:has-text("\u767B\u5F55")';
     const submitButton = page.locator(submitSelector).first();
     try {
       await page.waitForSelector('button[type="submit"]:not([disabled])', {
-        timeout: 5e3
+        timeout: 4e3
       });
       await submitButton.click();
     } catch {
-      await page.keyboard.press("Enter");
+      const isDisabled = await submitButton.isDisabled().catch(() => true);
+      if (!isDisabled) {
+        await submitButton.click({ force: true }).catch(() => {
+        });
+      } else {
+        if (!page.url().includes("/auth") && await isPageLoggedIn(page, 2e3)) {
+          return { success: true };
+        }
+      }
     }
     const postSubmitDeadline = Date.now() + 15e3;
     while (Date.now() < postSubmitDeadline) {
@@ -6251,6 +6382,137 @@ async function loginViaUi(page, email, password) {
     return { success: false, reason: err?.message || String(err) };
   }
 }
+async function refreshAccountToken(accountId) {
+  const page = accountPages.get(accountId);
+  if (!page || page.isClosed()) {
+    return { success: false, error: "Account page not active" };
+  }
+  const { getValidAuthSession: getValidAuthSession2, saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  const session = getValidAuthSession2(accountId);
+  let refreshToken = session?.refreshToken;
+  if (!refreshToken) {
+    try {
+      refreshToken = await page.evaluate(() => localStorage.getItem("refresh_token") || "") || void 0;
+    } catch {
+    }
+  }
+  if (refreshToken) {
+    try {
+      const refreshResult = await page.evaluate(
+        async ({ rTok }) => {
+          try {
+            const response = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+              method: "GET",
+              credentials: "include",
+              headers: {
+                accept: "application/json, text/plain, */*",
+                source: "web",
+                version: "0.3.11",
+                "x-request-origin": "https://chat.qwen.ai",
+                timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0],
+                authorization: `Bearer ${rTok}`
+              }
+            });
+            const json2 = await response.json().catch(() => null);
+            return { ok: response.ok, status: response.status, data: json2 };
+          } catch (e) {
+            return { ok: false, error: e.message };
+          }
+        },
+        { rTok: refreshToken }
+      );
+      const json = refreshResult?.data;
+      if (json && json.success === true && json.data) {
+        const newAccessToken = json.data.access_token || json.data.token;
+        const newRefreshToken = json.data.refresh_token || refreshToken;
+        if (newAccessToken) {
+          await page.context().addCookies([
+            {
+              name: "token",
+              value: newAccessToken,
+              domain: ".qwen.ai",
+              path: "/",
+              expires: Math.floor(Date.now() / 1e3) + 31536e3,
+              httpOnly: false,
+              secure: true,
+              sameSite: "Lax"
+            }
+          ]);
+          await page.evaluate(
+            ({ tok, rTok }) => {
+              try {
+                localStorage.removeItem("qwen_token_logged_out_marker");
+                localStorage.setItem("token", tok);
+                localStorage.setItem("access_token", tok);
+                if (rTok) localStorage.setItem("refresh_token", rTok);
+                document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+              } catch {
+              }
+            },
+            { tok: newAccessToken, rTok: newRefreshToken }
+          ).catch(() => {
+          });
+          const liveCookies = await page.context().cookies();
+          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+          const cache3 = getHeaderCache(accountId);
+          cache3.headers.cookie = cookieStr;
+          cache3.lastRefresh = Date.now();
+          markAccountHeadersReady(accountId);
+          saveAuthSession2(accountId, {
+            cookie: cookieStr,
+            userAgent: cache3.headers["user-agent"] || session?.userAgent || "",
+            bxV: cache3.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxUa: cache3.headers["bx-ua"] || session?.bxUa || "",
+            bxUmidtoken: cache3.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+            secChUa: cache3.headers["sec-ch-ua"] || session?.secChUa,
+            secChUaMobile: cache3.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+            secChUaPlatform: cache3.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+            version: cache3.headers["version"] || session?.version,
+            userId: session?.userId,
+            tokenExpiresAt: parseJwtExpiry(newAccessToken) || void 0,
+            refreshToken: newRefreshToken,
+            capturedAt: Date.now()
+          });
+          return { success: true, token: newAccessToken };
+        }
+      }
+    } catch {
+    }
+  }
+  const { getAccountCredentials: getAccountCredentials2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+  const creds = getAccountCredentials2(accountId);
+  if (creds && creds.email && creds.password) {
+    const apiResult = await loginViaApi(page, creds.email, creds.password);
+    if (apiResult.success) {
+      const liveCookies = await page.context().cookies();
+      const tokenCookie = liveCookies.find((c) => c.name === "token");
+      if (tokenCookie) {
+        const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+        const cache3 = getHeaderCache(accountId);
+        cache3.headers.cookie = cookieStr;
+        cache3.lastRefresh = Date.now();
+        markAccountHeadersReady(accountId);
+        saveAuthSession2(accountId, {
+          cookie: cookieStr,
+          userAgent: cache3.headers["user-agent"] || session?.userAgent || "",
+          bxV: cache3.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxUa: cache3.headers["bx-ua"] || session?.bxUa || "",
+          bxUmidtoken: cache3.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+          secChUa: cache3.headers["sec-ch-ua"] || session?.secChUa,
+          secChUaMobile: cache3.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+          secChUaPlatform: cache3.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+          version: cache3.headers["version"] || session?.version,
+          userId: session?.userId,
+          tokenExpiresAt: parseJwtExpiry(tokenCookie.value) || void 0,
+          refreshToken: apiResult.refreshToken,
+          capturedAt: Date.now()
+        });
+        return { success: true, token: tokenCookie.value };
+      }
+    }
+  }
+  return { success: false, error: "Could not refresh or re-authenticate token" };
+}
 async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.timeouts.headers, triggerGraceMs = HEADER_CAPTURE_TRIGGER_GRACE_MS) {
   const page = pageOverride ?? accountPages.get(accountId);
   if (!page || page.isClosed()) {
@@ -6767,6 +7029,10 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
         }
       };
       if (forceReauth) {
+        const refreshed = await refreshAccountToken(accountId);
+        if (refreshed.success) {
+          return;
+        }
         await executeReauth();
       } else {
         try {
@@ -7201,19 +7467,15 @@ async function keepAlivePlaywrightAccount(accountId) {
     const now = Date.now();
     const currentUrl = page.url();
     const cookie = await getCookies(accountId);
-    if (cookie && isTokenExpiringSoon(cookie, 45)) {
+    if (cookie && isTokenExpiringSoon(cookie, 5)) {
       console.log(
-        `\u{1F493} [SessionKeeper] Account ${accountId} token expires within 45m; proactively renewing session...`
+        `\u{1F493} [SessionKeeper] Account ${accountId} access token expiring soon (<5m); silently refreshing...`
       );
-      try {
-        await refreshHeadersInternal(accountId, config.timeouts.headers, true);
+      const res = await refreshAccountToken(accountId);
+      if (res.success) {
         lastKeepAliveNavigation.set(accountId, now);
         touchAccountActivity(accountId);
         return true;
-      } catch (err) {
-        console.warn(
-          `[SessionKeeper] Proactive session renewal failed for ${accountId}: ${getErrorMessage(err)}`
-        );
       }
     }
     const lastNavigation = lastKeepAliveNavigation.get(accountId) ?? 0;
@@ -9097,7 +9359,7 @@ function classifyRetryAction(err, options) {
       accountCooldownReason: "PersonalizationFailed"
     });
   }
-  if (code === "createchatinvalidresponse" || code === "createchatfailed" || code === "unauthorized" || message.includes("401 n\xE3o autorizado") || message.includes("n\xE3o tem permiss\xE3o para acessar") || message.includes("401 unauthorized") || message.includes('"code":"unauthorized"') || message.includes('"code": "unauthorized"')) {
+  if (code === "createchatinvalidresponse" || code === "createchatfailed" || code === "unauthorized" || message.includes("401 n\xE3o autorizado") || message.includes("n\xE3o tem permiss\xE3o para acessar") || message.includes("401 unauthorized") || message.includes('"code":"unauthorized"') || message.includes('"code": "unauthorized"') || message.includes("token has expired")) {
     return makeRetryAction("account_initialization_failed", {
       switchAccount: true,
       forceNewChat: true,
@@ -10574,6 +10836,16 @@ async function createQwenChatSession(headers, model, accountId, chatMode = "thre
       }
     }
     if (json?.data?.code === "Unauthorized" || json?.code === "Unauthorized" || rawLower.includes("unauthorized") || rawLower.includes("permission to access")) {
+      if (accountId) {
+        try {
+          const { refreshAccountToken: refreshAccountToken2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+          const refreshed = await refreshAccountToken2(accountId);
+          if (refreshed.success) {
+            return createQwenChatSession(headers, model, accountId, chatMode);
+          }
+        } catch {
+        }
+      }
       throw new QwenUpstreamError(
         `Qwen create chat unauthorized: ${raw.substring(0, 300)}`,
         "Unauthorized",
@@ -11269,16 +11541,28 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
         });
         if (response2.status === 401) {
           try {
-            const refreshRes = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
-              method: "GET",
-              credentials: "include",
-              signal: AbortSignal.timeout(3e3)
-            });
-            if (refreshRes.status === 200) {
+            const rTok = localStorage.getItem("refresh_token");
+            if (rTok) {
+              const refreshRes = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+                method: "GET",
+                credentials: "include",
+                headers: {
+                  accept: "application/json, text/plain, */*",
+                  source: "web",
+                  version: "0.3.11",
+                  "x-request-origin": "https://chat.qwen.ai",
+                  timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0],
+                  authorization: `Bearer ${rTok}`
+                },
+                signal: AbortSignal.timeout(5e3)
+              });
               const refreshJson = await refreshRes.json().catch(() => null);
-              if (refreshJson && refreshJson.success === true && refreshJson.data?.token) {
-                const freshTok = refreshJson.data.token;
+              const freshTok = refreshJson?.data?.access_token || refreshJson?.data?.token;
+              const nextRTok = refreshJson?.data?.refresh_token;
+              if (refreshJson?.success === true && freshTok) {
                 localStorage.setItem("token", freshTok);
+                localStorage.setItem("access_token", freshTok);
+                if (nextRTok) localStorage.setItem("refresh_token", nextRTok);
                 document.cookie = `token=${encodeURIComponent(freshTok)}; path=/; domain=.qwen.ai; max-age=31536000`;
                 if (headers2["authorization"] || headers2["Authorization"]) {
                   headers2["authorization"] = `Bearer ${freshTok}`;
@@ -11316,13 +11600,29 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
     }
   );
   const recoverOnTimeout = !options.noMutexRecovery;
-  const response = await withQwenBrowserPage(
+  let response = await withQwenBrowserPage(
     accountId,
     evaluateRequest,
     void 0,
     options.timeoutMs,
     recoverOnTimeout
   );
+  if (response.status === 401 && accountId) {
+    try {
+      const { refreshAccountToken: refreshAccountToken2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+      const refreshed = await refreshAccountToken2(accountId);
+      if (refreshed.success) {
+        response = await withQwenBrowserPage(
+          accountId,
+          evaluateRequest,
+          void 0,
+          options.timeoutMs,
+          recoverOnTimeout
+        );
+      }
+    } catch {
+    }
+  }
   return new Response(response.raw, {
     status: response.status,
     headers: response.contentType ? { "content-type": response.contentType } : void 0
@@ -11845,7 +12145,11 @@ async function syncQwenRequestPersonalization(instruction, accountId, metadata =
     );
     try {
       currentSettings = null;
-      const { headers: freshHeaders } = await getQwenHeaders(true, accountId, true);
+      const { refreshAccountToken: refreshAccountToken2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+      if (accountId) {
+        await refreshAccountToken2(accountId);
+      }
+      const { headers: freshHeaders } = await getQwenHeaders(false, accountId);
       requestHeaders = buildCapturedQwenHeaders(freshHeaders, {
         referer: qwenUrl("/settings/personalization")
       });
@@ -25513,7 +25817,7 @@ function getAppVersion() {
     }
   } catch {
   }
-  cachedVersion = "v1.4.3";
+  cachedVersion = "v1.4.8";
   return cachedVersion;
 }
 var cachedVersion;