qwenproxy-cli 1.4.3 → 1.4.8

package/src/services/playwright.ts

@@ -995,8 +995,29 @@ export function getStealthScript(profile: FingerprintProfile): string {
         const _toBlob = HTMLCanvasElement.prototype.toBlob;
         const _getImageData = CanvasRenderingContext2D.prototype.getImageData;
 
+        function isCaptchaCanvas(canvas) {
+          try {
+            if (!canvas) return false;
+            const id = (canvas.id || "").toLowerCase();
+            const cls = (canvas.className || "").toLowerCase();
+            return (
+              id.includes("baxia") ||
+              id.includes("nc_") ||
+              id.includes("captcha") ||
+              id.includes("punish") ||
+              cls.includes("baxia") ||
+              cls.includes("nc_") ||
+              cls.includes("captcha") ||
+              Boolean(canvas.closest?.("#baxia-dialog, #baxia-punish, [class*='baxia'], [class*='nc_'], .auth-layout"))
+            );
+          } catch(e) {
+            return false;
+          }
+        }
+
         function addNoise(canvas) {
           try {
+            if (isCaptchaCanvas(canvas)) return;
             const ctx = canvas.getContext('2d');
             if (!ctx) return;
             const style = ctx.fillStyle;
@@ -1020,6 +1041,9 @@ export function getStealthScript(profile: FingerprintProfile): string {
 
         CanvasRenderingContext2D.prototype.getImageData = function(x, y, w, h) {
           const imageData = _getImageData.apply(this, arguments);
+          if (isCaptchaCanvas(this.canvas)) {
+            return imageData;
+          }
           const data = imageData.data;
           const maxPixels = Math.min(data.length / 4, 2500);
           for (let i = 0; i < maxPixels * 4; i += 4) {
@@ -1981,6 +2005,8 @@ export interface LoginAttemptResult {
   success: boolean;
   permanentFailure?: boolean;
   reason?: string;
+  token?: string;
+  refreshToken?: string;
 }
 
 export function classifyQwenAuthError(
@@ -2096,6 +2122,7 @@ async function loginToQwen(
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || undefined,
             version: cache.headers["version"] || undefined,
             tokenExpiresAt: exp || undefined,
+            refreshToken: apiResult.refreshToken,
             capturedAt: Date.now(),
           });
         }
@@ -2131,6 +2158,12 @@ async function loginToQwen(
           markAccountHeadersReady(accountId);
           const { saveAuthSession } = await import("../core/database.ts");
           const exp = parseJwtExpiry(tokenCookie.value);
+          let rTok = uiResult.refreshToken;
+          if (!rTok) {
+            try {
+              rTok = (await page.evaluate(() => localStorage.getItem("refresh_token") || "")) || undefined;
+            } catch {}
+          }
           saveAuthSession(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
@@ -2142,6 +2175,7 @@ async function loginToQwen(
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || undefined,
             version: cache.headers["version"] || undefined,
             tokenExpiresAt: exp || undefined,
+            refreshToken: rTok,
             capturedAt: Date.now(),
           });
         }
@@ -2206,41 +2240,65 @@ async function loginViaApi(
       .createHash("sha256")
       .update(password)
       .digest("hex");
-    const signinUrl = qwenUrl("/api/v2/auths/signin");
-
-    let signinSuccess = false;
-    let data: any = null;
 
-    if (page.request && typeof page.request.post === "function") {
-      try {
-        const response = await page.request.post(signinUrl, {
-          data: {
-            email,
-            password: hashedPassword,
-            login_type: "email",
-          },
-          headers: {
-            "content-type": "application/json",
-            accept: "application/json, text/plain, */*",
-            referer: qwenUrl("/auth"),
-            origin: qwenOrigin(),
-            source: "web",
-          },
-          timeout: 10_000,
-        });
-        data = await response.json().catch(() => null);
-        signinSuccess = Boolean(data && (data.success === true || data.token));
-      } catch {}
+    // Ensure the page is loaded at /auth so that same-site/CORS credentials and Baxia WAF headers are active
+    if (!page.url().includes("/auth")) {
+      await page.goto(qwenUrl("/auth"), {
+        waitUntil: "domcontentloaded",
+        timeout: config.timeouts.navigation,
+      }).catch(() => {});
+      await sleep(1000);
     }
 
-    if (!signinSuccess && !data) {
-      // Fallback to in-page evaluate fetch if page.request was unavailable
-      const requestId = crypto.randomUUID();
-      const evalRes = await page
+    const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
+    const requestId = crypto.randomUUID();
+
+    const evalRes = await page
+      .evaluate(
+        async ({ email, password, signinUrl, requestId }) => {
+          try {
+            const response = await fetch(signinUrl, {
+              method: "POST",
+              signal: AbortSignal.timeout(15_000),
+              credentials: "include",
+              headers: {
+                accept: "application/json, text/plain, */*",
+                "content-type": "application/json",
+                source: "web",
+                version: "0.3.11",
+                "x-request-origin": "https://chat.qwen.ai",
+                timezone: new Date().toString().split(" (")[0],
+                "x-request-id": requestId,
+              },
+              body: JSON.stringify({ email, password }),
+            });
+            const json = await response.json().catch(() => null);
+            return { ok: response.ok, status: response.status, data: json };
+          } catch (e: any) {
+            return { ok: false, error: e.message };
+          }
+        },
+        { email, password: hashedPassword, signinUrl, requestId },
+      )
+      .catch(() => null);
+
+    let data: any = evalRes?.data;
+    let signinSuccess = Boolean(
+      data &&
+      (data.success === true ||
+        data.token ||
+        data.data?.access_token ||
+        data.data?.token),
+    );
+
+    // Fallback to legacy chat.qwen.ai endpoint if auth.qwen.ai did not succeed
+    if (!signinSuccess && !data?.data?.code) {
+      const fallbackUrl = qwenUrl("/api/v2/auths/signin");
+      const fallbackRes = await page
         .evaluate(
-          async ({ email, password, signinUrl, requestId }) => {
+          async ({ email, password, fallbackUrl, requestId }) => {
             try {
-              const response = await fetch(signinUrl, {
+              const response = await fetch(fallbackUrl, {
                 method: "POST",
                 signal: AbortSignal.timeout(10_000),
                 credentials: "include",
@@ -2248,10 +2306,11 @@ async function loginViaApi(
                   accept: "application/json, text/plain, */*",
                   "content-type": "application/json",
                   source: "web",
+                  version: "0.3.11",
                   timezone: new Date().toString().split(" (")[0],
                   "x-request-id": requestId,
                 },
-                body: JSON.stringify({ email, password, login_type: "email" }),
+                body: JSON.stringify({ email, password }),
               });
               const json = await response.json().catch(() => null);
               return { ok: response.ok, status: response.status, data: json };
@@ -2259,13 +2318,19 @@ async function loginViaApi(
               return { ok: false, error: e.message };
             }
           },
-          { email, password: hashedPassword, signinUrl, requestId },
+          { email, password: hashedPassword, fallbackUrl, requestId },
         )
         .catch(() => null);
 
-      if (evalRes?.data) {
-        data = evalRes.data;
-        signinSuccess = Boolean(data && (data.success === true || data.token));
+      if (fallbackRes?.data) {
+        data = fallbackRes.data;
+        signinSuccess = Boolean(
+          data &&
+          (data.success === true ||
+            data.token ||
+            data.data?.access_token ||
+            data.data?.token),
+        );
       }
     }
 
@@ -2281,7 +2346,14 @@ async function loginViaApi(
     }
 
     if (signinSuccess) {
-      const token = data?.data?.token || data?.token;
+      const token =
+        data?.data?.access_token ||
+        data?.data?.token ||
+        data?.access_token ||
+        data?.token;
+      const refreshToken =
+        data?.data?.refresh_token || data?.refresh_token;
+
       if (token) {
         try {
           await page.context().addCookies([
@@ -2308,16 +2380,21 @@ async function loginViaApi(
 
       if (token) {
         await page
-          .evaluate((tok) => {
-            try {
-              localStorage.removeItem("qwen_token_logged_out_marker");
-              localStorage.setItem("token", tok);
-              document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
-            } catch {}
-          }, token)
+          .evaluate(
+            ({ tok, rTok }) => {
+              try {
+                localStorage.removeItem("qwen_token_logged_out_marker");
+                localStorage.setItem("token", tok);
+                localStorage.setItem("access_token", tok);
+                if (rTok) localStorage.setItem("refresh_token", rTok);
+                document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+              } catch {}
+            },
+            { tok: token, rTok: refreshToken },
+          )
           .catch(() => {});
         await page.reload({ waitUntil: "domcontentloaded" }).catch(() => {});
-        return { success: true };
+        return { success: true, token, refreshToken };
       }
     }
 
@@ -2346,11 +2423,28 @@ async function loginViaUi(
   password: string,
 ): Promise<LoginAttemptResult> {
   try {
-    await page.goto(qwenUrl("/auth"), {
-      waitUntil: "domcontentloaded",
-      timeout: config.timeouts.navigation,
-    });
-    await sleep(1500);
+    // 0. If the page is ALREADY logged in, avoid touching /auth altogether!
+    if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 2000).catch(() => false))) {
+      return { success: true };
+    }
+
+    try {
+      await page.goto(qwenUrl("/auth"), {
+        waitUntil: "domcontentloaded",
+        timeout: Math.min(config.timeouts.navigation, 15_000),
+      });
+      await sleep(1000);
+    } catch (gotoErr: any) {
+      // If navigation was aborted because the page redirected to / (because already logged in):
+      if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000).catch(() => false))) {
+        return { success: true };
+      }
+    }
+
+    // Check if redirect occurred after navigation
+    if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000).catch(() => false))) {
+      return { success: true };
+    }
 
     // Wait for email input
     const emailSelector = [
@@ -2362,7 +2456,7 @@ async function loginViaUi(
     ].join(", ");
     try {
       await page.waitForSelector(emailSelector, {
-        timeout: Math.min(config.timeouts.page, 8_000),
+        timeout: Math.min(config.timeouts.page, 5_000),
       });
     } catch {
       if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000))) {
@@ -2379,35 +2473,77 @@ async function loginViaUi(
     // (supporting English, Portuguese, Spanish, Chinese) to reveal the standard email + password form.
     await clearVisibleChallenge(page);
 
-    const findPasswordModeButton = () => {
-      return page
-        .locator('button, [role="button"], a, div')
+    const isPasswordInputPresent = async () => {
+      return (await page.locator('input[type="password"], input[name="password"]').count().catch(() => 0)) > 0;
+    };
+
+    const revealPasswordMode = async () => {
+      // If already on /forget, navigate back to /auth
+      if (page.url().includes("/forget")) {
+        await page.goto(qwenUrl("/auth"), { waitUntil: "domcontentloaded", timeout: 10_000 }).catch(() => {});
+        await sleep(1000);
+      }
+
+      // If password input is already in DOM, do NOT click any switch buttons!
+      if (await isPasswordInputPresent()) return;
+
+      // 1. Playwright button locator with multilingual matching (strictly excluding "Esqueci a senha" / "Forgot password")
+      const btn = page
+        .locator("button")
         .filter({
           hasText: /(?:log\s*in\s*with\s*(?:a\s*)?password|fazer\s*login\s*com\s*senha|entrar\s*com\s*(?:uma\s*)?senha|iniciar\s*sesi[oó]n\s*con\s*contrase[nñ]a|密码登录)/i,
         })
+        .filter({
+          hasNotText: /(?:esqueci|forgot|olvid|reset|recover)/i,
+        })
         .first();
-    };
 
-    try {
-      const pwdModeBtn = findPasswordModeButton();
-      if (await pwdModeBtn.isVisible({ timeout: 2000 }).catch(() => false)) {
-        await pwdModeBtn.click({ timeout: 2000 }).catch(() => {});
+      if (await btn.isVisible({ timeout: 1500 }).catch(() => false)) {
+        await btn.click({ timeout: 2000 }).catch(() => {});
         await sleep(500);
       }
-    } catch {}
 
-    // Fill email
-    await page.fill(emailSelector, email);
-    await sleep(300);
+      if (await isPasswordInputPresent()) return;
 
-    // If "Log in with a password" button appeared after typing email, click it
+      // 2. In-page evaluate fail-safe to trigger direct DOM click on the password button
+      await page
+        .evaluate(() => {
+          try {
+            const buttons = Array.from(document.querySelectorAll("button, [role='button'], a"));
+            for (const b of buttons) {
+              const txt = ((b as HTMLElement).innerText || "").trim().toLowerCase();
+              if (
+                /(?:log\s*in\s*with\s*(?:a\s*)?password|fazer\s*login\s*com\s*senha|entrar\s*com\s*(?:uma\s*)?senha|iniciar\s*sesi[oó]n\s*con\s*contrase[nñ]a|密码登录)/i.test(txt) &&
+                !txt.includes("esqueci") && !txt.includes("forgot") && !txt.includes("olvid") && !txt.includes("reset")
+              ) {
+                (b as HTMLElement).click();
+                return true;
+              }
+            }
+          } catch {}
+          return false;
+        })
+        .catch(() => false);
+      await sleep(500);
+    };
+
+    await revealPasswordMode();
+
+    // Fill email
     try {
-      const pwdModeBtn = findPasswordModeButton();
-      if (await pwdModeBtn.isVisible({ timeout: 1500 }).catch(() => false)) {
-        await pwdModeBtn.click({ timeout: 2000 }).catch(() => {});
-        await sleep(500);
+      await page.fill(emailSelector, email, { timeout: 8_000 });
+      await sleep(300);
+    } catch {
+      if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000))) {
+        return { success: true };
       }
-    } catch {}
+      throw new Error(`Campo de e-mail não encontrado na tela de autenticação`);
+    }
+
+    // If password field is still not visible after typing email, trigger reveal again
+    if (!(await isPasswordInputPresent())) {
+      await revealPasswordMode();
+    }
 
     // In Qwen Web, the password field is present on the same form.
     // NEVER press Enter after filling email alone, as Qwen interprets that
@@ -2432,21 +2568,54 @@ async function loginViaUi(
     }
 
     // Fill password
-    await page.fill(passwordSelector, password);
-    await sleep(500);
+    try {
+      await page.fill(passwordSelector, password, { timeout: 8_000 });
+      await sleep(500);
+    } catch {
+      if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 3000))) {
+        return { success: true };
+      }
+      throw new Error(`Campo de senha não encontrado na tela de autenticação`);
+    }
+
+    // Dispatch input/change/blur events so Ant Design / React enables the submit button
+    await page
+      .evaluate(() => {
+        try {
+          const emailEl = document.querySelector('input[name="email"], input[type="email"], input[type="text"]');
+          const passEl = document.querySelector('input[type="password"], input[name="password"]');
+          if (emailEl) {
+            emailEl.dispatchEvent(new Event("input", { bubbles: true }));
+            emailEl.dispatchEvent(new Event("change", { bubbles: true }));
+            emailEl.dispatchEvent(new Event("blur", { bubbles: true }));
+          }
+          if (passEl) {
+            passEl.dispatchEvent(new Event("input", { bubbles: true }));
+            passEl.dispatchEvent(new Event("change", { bubbles: true }));
+            passEl.dispatchEvent(new Event("blur", { bubbles: true }));
+          }
+        } catch {}
+      })
+      .catch(() => {});
 
-    // Prefer clicking the submit button; fall back to pressing Enter.
-    // The button starts disabled and only enables once both fields are filled.
+    // Prefer clicking the submit button; do NOT press Enter if disabled
     const submitSelector =
       'button.qwenchat-auth-pc-submit-button, button[type="submit"], button:has-text("Log in"), button:has-text("Sign in"), button:has-text("Fazer login"), button:has-text("Entrar"), button:has-text("Iniciar sesión"), button:has-text("登录")';
     const submitButton = page.locator(submitSelector).first();
     try {
       await page.waitForSelector('button[type="submit"]:not([disabled])', {
-        timeout: 5_000,
+        timeout: 4_000,
       });
       await submitButton.click();
     } catch {
-      await page.keyboard.press("Enter");
+      const isDisabled = await submitButton.isDisabled().catch(() => true);
+      if (!isDisabled) {
+        await submitButton.click({ force: true }).catch(() => {});
+      } else {
+        if (!page.url().includes("/auth") && (await isPageLoggedIn(page, 2000))) {
+          return { success: true };
+        }
+      }
     }
     // Post-submit verification loop: wait up to 15s for captcha, redirect, cookies, or errors
     const postSubmitDeadline = Date.now() + 15_000;
@@ -2531,6 +2700,161 @@ async function loginViaUi(
   }
 }
 
+/**
+ * Silently refresh the short-lived access token (15m) using the 30-day refresh_token.
+ * Uses official in-page fetch matching Qwen Web /api/v2/auths/refresh verified in HAR.
+ */
+export async function refreshAccountToken(
+  accountId: string,
+): Promise<{ success: boolean; token?: string; error?: string }> {
+  const page = accountPages.get(accountId);
+  if (!page || page.isClosed()) {
+    return { success: false, error: "Account page not active" };
+  }
+
+  // 1. Get refresh token from SQLite session or localStorage
+  const { getValidAuthSession, saveAuthSession } = await import("../core/database.ts");
+  const session = getValidAuthSession(accountId);
+  let refreshToken = session?.refreshToken;
+
+  if (!refreshToken) {
+    try {
+      refreshToken =
+        (await page.evaluate(() => localStorage.getItem("refresh_token") || "")) ||
+        undefined;
+    } catch {}
+  }
+
+  // 2. If we have a refresh token, invoke the working refresh endpoint in-page
+  if (refreshToken) {
+    try {
+      const refreshResult = await page.evaluate(
+        async ({ rTok }) => {
+          try {
+            const response = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+              method: "GET",
+              credentials: "include",
+              headers: {
+                accept: "application/json, text/plain, */*",
+                source: "web",
+                version: "0.3.11",
+                "x-request-origin": "https://chat.qwen.ai",
+                timezone: new Date().toString().split(" (")[0],
+                authorization: `Bearer ${rTok}`,
+              },
+            });
+            const json = await response.json().catch(() => null);
+            return { ok: response.ok, status: response.status, data: json };
+          } catch (e: any) {
+            return { ok: false, error: e.message };
+          }
+        },
+        { rTok: refreshToken },
+      );
+
+      const json = refreshResult?.data;
+      if (json && json.success === true && json.data) {
+        const newAccessToken = json.data.access_token || json.data.token;
+        const newRefreshToken = json.data.refresh_token || refreshToken;
+
+        if (newAccessToken) {
+          // Update browser cookie and localStorage
+          await page.context().addCookies([
+            {
+              name: "token",
+              value: newAccessToken,
+              domain: ".qwen.ai",
+              path: "/",
+              expires: Math.floor(Date.now() / 1000) + 31536000,
+              httpOnly: false,
+              secure: true,
+              sameSite: "Lax",
+            },
+          ]);
+
+          await page
+            .evaluate(
+              ({ tok, rTok }) => {
+                try {
+                  localStorage.removeItem("qwen_token_logged_out_marker");
+                  localStorage.setItem("token", tok);
+                  localStorage.setItem("access_token", tok);
+                  if (rTok) localStorage.setItem("refresh_token", rTok);
+                  document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+                } catch {}
+              },
+              { tok: newAccessToken, rTok: newRefreshToken },
+            )
+            .catch(() => {});
+
+          // Update memory cache
+          const liveCookies = await page.context().cookies();
+          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+          const cache = getHeaderCache(accountId);
+          cache.headers.cookie = cookieStr;
+          cache.lastRefresh = Date.now();
+          markAccountHeadersReady(accountId);
+
+          // Update SQLite session with new tokens
+          saveAuthSession(accountId, {
+            cookie: cookieStr,
+            userAgent: cache.headers["user-agent"] || session?.userAgent || "",
+            bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
+            bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+            secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
+            secChUaMobile: cache.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+            secChUaPlatform: cache.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+            version: cache.headers["version"] || session?.version,
+            userId: session?.userId,
+            tokenExpiresAt: parseJwtExpiry(newAccessToken) || undefined,
+            refreshToken: newRefreshToken,
+            capturedAt: Date.now(),
+          });
+
+          return { success: true, token: newAccessToken };
+        }
+      }
+    } catch {}
+  }
+
+  // 3. Fallback: if refresh_token was invalid/absent or refresh failed, do clean API login
+  const { getAccountCredentials } = await import("../core/accounts.ts");
+  const creds = getAccountCredentials(accountId);
+  if (creds && creds.email && creds.password) {
+    const apiResult = await loginViaApi(page, creds.email, creds.password);
+    if (apiResult.success) {
+      const liveCookies = await page.context().cookies();
+      const tokenCookie = liveCookies.find((c) => c.name === "token");
+      if (tokenCookie) {
+        const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+        const cache = getHeaderCache(accountId);
+        cache.headers.cookie = cookieStr;
+        cache.lastRefresh = Date.now();
+        markAccountHeadersReady(accountId);
+        saveAuthSession(accountId, {
+          cookie: cookieStr,
+          userAgent: cache.headers["user-agent"] || session?.userAgent || "",
+          bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
+          bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+          secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
+          secChUaMobile: cache.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+          secChUaPlatform: cache.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+          version: cache.headers["version"] || session?.version,
+          userId: session?.userId,
+          tokenExpiresAt: parseJwtExpiry(tokenCookie.value) || undefined,
+          refreshToken: apiResult.refreshToken,
+          capturedAt: Date.now(),
+        });
+        return { success: true, token: tokenCookie.value };
+      }
+    }
+  }
+
+  return { success: false, error: "Could not refresh or re-authenticate token" };
+}
+
 // ─── Header Capture ───────────────────────────────────────────────────────────
 
 /**
@@ -3251,6 +3575,11 @@ async function refreshHeadersInternal(
       };
 
       if (forceReauth) {
+        // Try silent token refresh first using the 30-day refresh_token or direct API signin!
+        const refreshed = await refreshAccountToken(accountId);
+        if (refreshed.success) {
+          return;
+        }
         await executeReauth();
       } else {
         try {
@@ -3848,21 +4177,17 @@ export async function keepAlivePlaywrightAccount(
     const now = Date.now();
     const currentUrl = page.url();
 
-    // Proactive session check: if token expires within 45 minutes, refresh proactively
+    // Proactive session check: if token expires within 5 minutes, refresh in-page silently using refreshAccountToken
     const cookie = await getCookies(accountId);
-    if (cookie && isTokenExpiringSoon(cookie, 45)) {
+    if (cookie && isTokenExpiringSoon(cookie, 5)) {
       console.log(
-        `💓 [SessionKeeper] Account ${accountId} token expires within 45m; proactively renewing session...`,
+        `💓 [SessionKeeper] Account ${accountId} access token expiring soon (<5m); silently refreshing...`,
       );
-      try {
-        await refreshHeadersInternal(accountId, config.timeouts.headers, true);
+      const res = await refreshAccountToken(accountId);
+      if (res.success) {
         lastKeepAliveNavigation.set(accountId, now);
         touchAccountActivity(accountId);
         return true;
-      } catch (err) {
-        console.warn(
-          `[SessionKeeper] Proactive session renewal failed for ${accountId}: ${getErrorMessage(err)}`,
-        );
       }
     }
 

package/src/services/qwen-chat-pool.ts

@@ -77,6 +77,15 @@ async function createQwenChatSession(
       rawLower.includes("unauthorized") ||
       rawLower.includes("permission to access")
     ) {
+      if (accountId) {
+        try {
+          const { refreshAccountToken } = await import("./playwright.ts");
+          const refreshed = await refreshAccountToken(accountId);
+          if (refreshed.success) {
+            return createQwenChatSession(headers, model, accountId, chatMode);
+          }
+        } catch {}
+      }
       throw new QwenUpstreamError(
         `Qwen create chat unauthorized: ${raw.substring(0, 300)}`,
         "Unauthorized",