qwenproxy-cli 1.4.7 → 1.4.8

package/dist/login.js

@@ -359,6 +359,7 @@ function runMigrations(db2) {
     "sec_ch_ua_mobile TEXT",
     "sec_ch_ua_platform TEXT",
     "version TEXT",
+    "refresh_token TEXT",
     "captured_at INTEGER DEFAULT 0"
   ];
   for (const col of authSessionCols) {
@@ -437,11 +438,11 @@ function saveAuthSession(accountId, session) {
     INSERT OR REPLACE INTO qwen_auth_sessions (
       account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
       sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-      user_id, token_expires_at, captured_at, updated_at
+      user_id, token_expires_at, refresh_token, captured_at, updated_at
     ) VALUES (
       ?, ?, ?, ?, ?, ?,
       ?, ?, ?, ?,
-      ?, ?, ?, datetime('now')
+      ?, ?, ?, ?, datetime('now')
     )
   `);
   stmt.run(
@@ -457,6 +458,7 @@ function saveAuthSession(accountId, session) {
     session.version || null,
     session.userId || null,
     session.tokenExpiresAt || null,
+    session.refreshToken || null,
     session.capturedAt ?? Date.now()
   );
 }
@@ -465,7 +467,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
   const row = database.prepare(
     `SELECT account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
               sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-              user_id, token_expires_at, captured_at
+              user_id, token_expires_at, refresh_token, captured_at
        FROM qwen_auth_sessions WHERE account_id = ?`
   ).get(accountId);
   if (!row) return null;
@@ -473,7 +475,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
   if (capturedAt <= 0 || Date.now() - capturedAt > maxAgeMs) {
     return null;
   }
-  if (row.token_expires_at) {
+  if (!row.refresh_token && row.token_expires_at) {
     const tokenExpMs = Number(row.token_expires_at) * 1e3;
     if (tokenExpMs <= Date.now() + 5 * 60 * 1e3) {
       return null;
@@ -495,6 +497,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
     version: row.version || void 0,
     userId: row.user_id || void 0,
     tokenExpiresAt: row.token_expires_at ? Number(row.token_expires_at) : void 0,
+    refreshToken: row.refresh_token || void 0,
     capturedAt
   };
 }
@@ -3137,6 +3140,7 @@ __export(playwright_exports, {
   parseCookiesForBrowser: () => parseCookiesForBrowser,
   pruneAllPlaywrightProfiles: () => pruneAllPlaywrightProfiles,
   prunePlaywrightProfileCaches: () => prunePlaywrightProfileCaches,
+  refreshAccountToken: () => refreshAccountToken,
   refreshHeaders: () => refreshHeaders,
   refreshHeadersWithProfileReset: () => refreshHeadersWithProfileReset,
   registerPlaywrightAccountForTests: () => registerPlaywrightAccountForTests,
@@ -4772,6 +4776,7 @@ async function loginToQwen(accountId, email, password) {
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || void 0,
             version: cache.headers["version"] || void 0,
             tokenExpiresAt: exp || void 0,
+            refreshToken: apiResult.refreshToken,
             capturedAt: Date.now()
           });
         }
@@ -4805,6 +4810,13 @@ async function loginToQwen(accountId, email, password) {
           markAccountHeadersReady(accountId);
           const { saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
           const exp = parseJwtExpiry(tokenCookie.value);
+          let rTok = uiResult.refreshToken;
+          if (!rTok) {
+            try {
+              rTok = await page.evaluate(() => localStorage.getItem("refresh_token") || "") || void 0;
+            } catch {
+            }
+          }
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
@@ -4816,6 +4828,7 @@ async function loginToQwen(accountId, email, password) {
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || void 0,
             version: cache.headers["version"] || void 0,
             tokenExpiresAt: exp || void 0,
+            refreshToken: rTok,
             capturedAt: Date.now()
           });
         }
@@ -4994,7 +5007,7 @@ async function loginViaApi(page, email, password) {
         });
         await page.reload({ waitUntil: "domcontentloaded" }).catch(() => {
         });
-        return { success: true };
+        return { success: true, token, refreshToken };
       }
     }
     return {
@@ -5237,6 +5250,137 @@ async function loginViaUi(page, email, password) {
     return { success: false, reason: err?.message || String(err) };
   }
 }
+async function refreshAccountToken(accountId) {
+  const page = accountPages.get(accountId);
+  if (!page || page.isClosed()) {
+    return { success: false, error: "Account page not active" };
+  }
+  const { getValidAuthSession: getValidAuthSession2, saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  const session = getValidAuthSession2(accountId);
+  let refreshToken = session?.refreshToken;
+  if (!refreshToken) {
+    try {
+      refreshToken = await page.evaluate(() => localStorage.getItem("refresh_token") || "") || void 0;
+    } catch {
+    }
+  }
+  if (refreshToken) {
+    try {
+      const refreshResult = await page.evaluate(
+        async ({ rTok }) => {
+          try {
+            const response = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+              method: "GET",
+              credentials: "include",
+              headers: {
+                accept: "application/json, text/plain, */*",
+                source: "web",
+                version: "0.3.11",
+                "x-request-origin": "https://chat.qwen.ai",
+                timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0],
+                authorization: `Bearer ${rTok}`
+              }
+            });
+            const json2 = await response.json().catch(() => null);
+            return { ok: response.ok, status: response.status, data: json2 };
+          } catch (e) {
+            return { ok: false, error: e.message };
+          }
+        },
+        { rTok: refreshToken }
+      );
+      const json = refreshResult?.data;
+      if (json && json.success === true && json.data) {
+        const newAccessToken = json.data.access_token || json.data.token;
+        const newRefreshToken = json.data.refresh_token || refreshToken;
+        if (newAccessToken) {
+          await page.context().addCookies([
+            {
+              name: "token",
+              value: newAccessToken,
+              domain: ".qwen.ai",
+              path: "/",
+              expires: Math.floor(Date.now() / 1e3) + 31536e3,
+              httpOnly: false,
+              secure: true,
+              sameSite: "Lax"
+            }
+          ]);
+          await page.evaluate(
+            ({ tok, rTok }) => {
+              try {
+                localStorage.removeItem("qwen_token_logged_out_marker");
+                localStorage.setItem("token", tok);
+                localStorage.setItem("access_token", tok);
+                if (rTok) localStorage.setItem("refresh_token", rTok);
+                document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+              } catch {
+              }
+            },
+            { tok: newAccessToken, rTok: newRefreshToken }
+          ).catch(() => {
+          });
+          const liveCookies = await page.context().cookies();
+          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+          const cache = getHeaderCache(accountId);
+          cache.headers.cookie = cookieStr;
+          cache.lastRefresh = Date.now();
+          markAccountHeadersReady(accountId);
+          saveAuthSession2(accountId, {
+            cookie: cookieStr,
+            userAgent: cache.headers["user-agent"] || session?.userAgent || "",
+            bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
+            bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+            secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
+            secChUaMobile: cache.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+            secChUaPlatform: cache.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+            version: cache.headers["version"] || session?.version,
+            userId: session?.userId,
+            tokenExpiresAt: parseJwtExpiry(newAccessToken) || void 0,
+            refreshToken: newRefreshToken,
+            capturedAt: Date.now()
+          });
+          return { success: true, token: newAccessToken };
+        }
+      }
+    } catch {
+    }
+  }
+  const { getAccountCredentials: getAccountCredentials2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+  const creds = getAccountCredentials2(accountId);
+  if (creds && creds.email && creds.password) {
+    const apiResult = await loginViaApi(page, creds.email, creds.password);
+    if (apiResult.success) {
+      const liveCookies = await page.context().cookies();
+      const tokenCookie = liveCookies.find((c) => c.name === "token");
+      if (tokenCookie) {
+        const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+        const cache = getHeaderCache(accountId);
+        cache.headers.cookie = cookieStr;
+        cache.lastRefresh = Date.now();
+        markAccountHeadersReady(accountId);
+        saveAuthSession2(accountId, {
+          cookie: cookieStr,
+          userAgent: cache.headers["user-agent"] || session?.userAgent || "",
+          bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
+          bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+          secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
+          secChUaMobile: cache.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+          secChUaPlatform: cache.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+          version: cache.headers["version"] || session?.version,
+          userId: session?.userId,
+          tokenExpiresAt: parseJwtExpiry(tokenCookie.value) || void 0,
+          refreshToken: apiResult.refreshToken,
+          capturedAt: Date.now()
+        });
+        return { success: true, token: tokenCookie.value };
+      }
+    }
+  }
+  return { success: false, error: "Could not refresh or re-authenticate token" };
+}
 async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.timeouts.headers, triggerGraceMs = HEADER_CAPTURE_TRIGGER_GRACE_MS) {
   const page = pageOverride ?? accountPages.get(accountId);
   if (!page || page.isClosed()) {
@@ -5753,16 +5897,9 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
         }
       };
       if (forceReauth) {
-        const alreadyIn = await isPageLoggedIn(page, 2e3).catch(() => false);
-        if (alreadyIn) {
-          const liveCookies = await page.context().cookies();
-          if (liveCookies.some((c) => c.name === "token")) {
-            const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
-            cache.headers.cookie = cookieStr;
-            cache.lastRefresh = Date.now();
-            markAccountHeadersReady(accountId);
-            return;
-          }
+        const refreshed = await refreshAccountToken(accountId);
+        if (refreshed.success) {
+          return;
         }
         await executeReauth();
       } else {
@@ -6198,50 +6335,15 @@ async function keepAlivePlaywrightAccount(accountId) {
     const now = Date.now();
     const currentUrl = page.url();
     const cookie = await getCookies(accountId);
-    if (cookie && isTokenExpiringSoon(cookie, 2)) {
-      try {
-        await page.evaluate(async () => {
-          await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
-            method: "GET",
-            credentials: "include"
-          }).catch(() => {
-          });
-          await fetch("/api/v1/auths/", {
-            method: "GET",
-            credentials: "include"
-          }).catch(() => {
-          });
-        }).catch(() => {
-        });
-        const liveCookies = await page.context().cookies();
-        const tokenCookie = liveCookies.find((c) => c.name === "token");
-        if (tokenCookie) {
-          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
-          const cache = getHeaderCache(accountId);
-          cache.headers.cookie = cookieStr;
-          cache.lastRefresh = Date.now();
-          markAccountHeadersReady(accountId);
-          lastKeepAliveNavigation.set(accountId, now);
-          touchAccountActivity(accountId);
-          return true;
-        }
-      } catch {
-      }
-      const loggedIn = await isPageLoggedIn(page, 2e3).catch(() => false);
-      if (!loggedIn) {
-        console.log(
-          `\u{1F493} [SessionKeeper] Account ${accountId} session expired; renewing session...`
-        );
-        try {
-          await refreshHeadersInternal(accountId, config.timeouts.headers, true);
-          lastKeepAliveNavigation.set(accountId, now);
-          touchAccountActivity(accountId);
-          return true;
-        } catch (err) {
-          console.warn(
-            `[SessionKeeper] Proactive session renewal failed for ${accountId}: ${getErrorMessage(err)}`
-          );
-        }
+    if (cookie && isTokenExpiringSoon(cookie, 5)) {
+      console.log(
+        `\u{1F493} [SessionKeeper] Account ${accountId} access token expiring soon (<5m); silently refreshing...`
+      );
+      const res = await refreshAccountToken(accountId);
+      if (res.success) {
+        lastKeepAliveNavigation.set(accountId, now);
+        touchAccountActivity(accountId);
+        return true;
       }
     }
     const lastNavigation = lastKeepAliveNavigation.get(accountId) ?? 0;

package/dist/reset-cooldowns.js

@@ -314,6 +314,7 @@ function runMigrations(db2) {
     "sec_ch_ua_mobile TEXT",
     "sec_ch_ua_platform TEXT",
     "version TEXT",
+    "refresh_token TEXT",
     "captured_at INTEGER DEFAULT 0"
   ];
   for (const col of authSessionCols) {
@@ -392,11 +393,11 @@ function saveAuthSession(accountId, session) {
     INSERT OR REPLACE INTO qwen_auth_sessions (
       account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
       sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-      user_id, token_expires_at, captured_at, updated_at
+      user_id, token_expires_at, refresh_token, captured_at, updated_at
     ) VALUES (
       ?, ?, ?, ?, ?, ?,
       ?, ?, ?, ?,
-      ?, ?, ?, datetime('now')
+      ?, ?, ?, ?, datetime('now')
     )
   `);
   stmt.run(
@@ -412,6 +413,7 @@ function saveAuthSession(accountId, session) {
     session.version || null,
     session.userId || null,
     session.tokenExpiresAt || null,
+    session.refreshToken || null,
     session.capturedAt ?? Date.now()
   );
 }
@@ -420,7 +422,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
   const row = database.prepare(
     `SELECT account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
               sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-              user_id, token_expires_at, captured_at
+              user_id, token_expires_at, refresh_token, captured_at
        FROM qwen_auth_sessions WHERE account_id = ?`
   ).get(accountId);
   if (!row) return null;
@@ -428,7 +430,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
   if (capturedAt <= 0 || Date.now() - capturedAt > maxAgeMs) {
     return null;
   }
-  if (row.token_expires_at) {
+  if (!row.refresh_token && row.token_expires_at) {
     const tokenExpMs = Number(row.token_expires_at) * 1e3;
     if (tokenExpMs <= Date.now() + 5 * 60 * 1e3) {
       return null;
@@ -450,6 +452,7 @@ function getValidAuthSession(accountId, maxAgeMs = 30 * 24 * 60 * 60 * 1e3) {
     version: row.version || void 0,
     userId: row.user_id || void 0,
     tokenExpiresAt: row.token_expires_at ? Number(row.token_expires_at) : void 0,
+    refreshToken: row.refresh_token || void 0,
     capturedAt
   };
 }
@@ -4048,6 +4051,7 @@ async function loginToQwen(accountId, email, password) {
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || void 0,
             version: cache.headers["version"] || void 0,
             tokenExpiresAt: exp || void 0,
+            refreshToken: apiResult.refreshToken,
             capturedAt: Date.now()
           });
         }
@@ -4081,6 +4085,13 @@ async function loginToQwen(accountId, email, password) {
           markAccountHeadersReady(accountId);
           const { saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
           const exp = parseJwtExpiry(tokenCookie.value);
+          let rTok = uiResult.refreshToken;
+          if (!rTok) {
+            try {
+              rTok = await page.evaluate(() => localStorage.getItem("refresh_token") || "") || void 0;
+            } catch {
+            }
+          }
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
@@ -4092,6 +4103,7 @@ async function loginToQwen(accountId, email, password) {
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || void 0,
             version: cache.headers["version"] || void 0,
             tokenExpiresAt: exp || void 0,
+            refreshToken: rTok,
             capturedAt: Date.now()
           });
         }
@@ -4270,7 +4282,7 @@ async function loginViaApi(page, email, password) {
         });
         await page.reload({ waitUntil: "domcontentloaded" }).catch(() => {
         });
-        return { success: true };
+        return { success: true, token, refreshToken };
       }
     }
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qwenproxy-cli",
-  "version": "1.4.7",
+  "version": "1.4.8",
   "description": "High-performance OpenAI & Anthropic compatible API gateway for Qwen with multi-account rotation, interactive TUI, and resilient tool calling.",
   "main": "src/index.ts",
   "bin": {

package/src/core/database.ts

@@ -193,6 +193,7 @@ function runMigrations(db: Database.Database): void {
     "sec_ch_ua_mobile TEXT",
     "sec_ch_ua_platform TEXT",
     "version TEXT",
+    "refresh_token TEXT",
     "captured_at INTEGER DEFAULT 0",
   ];
   for (const col of authSessionCols) {
@@ -309,6 +310,7 @@ export interface PersistedAuthSession {
   version?: string;
   userId?: string;
   tokenExpiresAt?: number;
+  refreshToken?: string;
   capturedAt: number;
 }
 
@@ -326,6 +328,7 @@ export function saveAuthSession(
     version?: string;
     userId?: string;
     tokenExpiresAt?: number;
+    refreshToken?: string;
     capturedAt?: number;
   },
 ): void {
@@ -334,11 +337,11 @@ export function saveAuthSession(
     INSERT OR REPLACE INTO qwen_auth_sessions (
       account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
       sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-      user_id, token_expires_at, captured_at, updated_at
+      user_id, token_expires_at, refresh_token, captured_at, updated_at
     ) VALUES (
       ?, ?, ?, ?, ?, ?,
       ?, ?, ?, ?,
-      ?, ?, ?, datetime('now')
+      ?, ?, ?, ?, datetime('now')
     )
   `);
   stmt.run(
@@ -354,6 +357,7 @@ export function saveAuthSession(
     session.version || null,
     session.userId || null,
     session.tokenExpiresAt || null,
+    session.refreshToken || null,
     session.capturedAt ?? Date.now(),
   );
 }
@@ -367,7 +371,7 @@ export function getValidAuthSession(
     .prepare(
       `SELECT account_id, cookie, user_agent, bx_v, bx_ua, bx_umidtoken,
               sec_ch_ua, sec_ch_ua_mobile, sec_ch_ua_platform, version,
-              user_id, token_expires_at, captured_at
+              user_id, token_expires_at, refresh_token, captured_at
        FROM qwen_auth_sessions WHERE account_id = ?`,
     )
     .get(accountId) as any;
@@ -379,9 +383,9 @@ export function getValidAuthSession(
     return null;
   }
 
-  if (row.token_expires_at) {
+  if (!row.refresh_token && row.token_expires_at) {
     const tokenExpMs = Number(row.token_expires_at) * 1000;
-    // Safety margin of 5 minutes before token expires
+    // Safety margin of 5 minutes before token expires (only when no refresh_token exists)
     if (tokenExpMs <= Date.now() + 5 * 60 * 1000) {
       return null;
     }
@@ -405,6 +409,7 @@ export function getValidAuthSession(
     version: row.version || undefined,
     userId: row.user_id || undefined,
     tokenExpiresAt: row.token_expires_at ? Number(row.token_expires_at) : undefined,
+    refreshToken: row.refresh_token || undefined,
     capturedAt,
   };
 }

package/src/core/version.ts

@@ -17,6 +17,6 @@ export function getAppVersion(): string {
       }
     }
   } catch {}
-  cachedVersion = "v1.4.7";
+  cachedVersion = "v1.4.8";
   return cachedVersion;
 }

package/src/routes/chat/retry-policy.ts

@@ -479,8 +479,8 @@ export function classifyRetryAction(
   // Agent instructions ride ONLY the account-level personalization. An
   // unconfirmed sync means this account cannot serve the request as-is —
   // rotate to another account (each attempt re-syncs on its own account).
-  // Park the failing account with PersonalizationFailed cooldown so it does
-  // not enter an infinite ping-pong loop when multiple accounts fail.
+  // Do NOT park the account with a 300s cooldown: rotation across accounts
+  // is already guarded by triedAccounts, preventing pool collapse.
   if (err instanceof PersonalizationSyncError) {
     return makeRetryAction("personalization_sync_failed", {
       switchAccount: true,
@@ -502,7 +502,8 @@ export function classifyRetryAction(
     message.includes("não tem permissão para acessar") ||
     message.includes("401 unauthorized") ||
     message.includes('"code":"unauthorized"') ||
-    message.includes('"code": "unauthorized"')
+    message.includes('"code": "unauthorized"') ||
+    message.includes("token has expired")
   ) {
     return makeRetryAction("account_initialization_failed", {
       switchAccount: true,