qwenproxy-cli 1.4.7 → 1.5.0

package/src/routes/chat/retry-policy.ts

@@ -479,21 +479,21 @@ export function classifyRetryAction(
   // Agent instructions ride ONLY the account-level personalization. An
   // unconfirmed sync means this account cannot serve the request as-is —
   // rotate to another account (each attempt re-syncs on its own account).
-  // Park the failing account with PersonalizationFailed cooldown so it does
-  // not enter an infinite ping-pong loop when multiple accounts fail.
+  // Do NOT park the account with a 300s cooldown: rotation across accounts
+  // is already guarded by triedAccounts, preventing pool collapse.
   if (err instanceof PersonalizationSyncError) {
     return makeRetryAction("personalization_sync_failed", {
       switchAccount: true,
       forceNewChat: true,
       retryAfterMs: baseDelayMs,
-      accountCooldownMs: config.concurrency.initFailureCooldownMs,
+      accountCooldownMs: 0,
       accountCooldownReason: "PersonalizationFailed",
     });
   }
 
   // Upstream 401 / Unauthorized on chat creation or API requests:
-  // Account session is invalid or expired. Cool down account with AuthInitFailed so the
-  // proxy rotates to a valid account instead of looping endlessly on 503s.
+  // Access token expired (15m window). Rotate without locking into a 300s cooldown
+  // so the account can immediately be renewed via refresh_token.
   if (
     code === "createchatinvalidresponse" ||
     code === "createchatfailed" ||
@@ -502,15 +502,16 @@ export function classifyRetryAction(
     message.includes("não tem permissão para acessar") ||
     message.includes("401 unauthorized") ||
     message.includes('"code":"unauthorized"') ||
-    message.includes('"code": "unauthorized"')
+    message.includes('"code": "unauthorized"') ||
+    message.includes("token has expired")
   ) {
     return makeRetryAction("account_initialization_failed", {
       switchAccount: true,
       forceNewChat: true,
       retryWithFullPrompt: true,
       retryAfterMs: Math.min(baseDelayMs, 1_000),
-      accountCooldownMs: config.concurrency.initFailureCooldownMs,
-      accountCooldownReason: "AuthInitFailed",
+      accountCooldownMs: 0,
+      accountCooldownReason: "AuthExpired",
     });
   }
   // Specialized recoveries first (even if wrapped as RetryableQwenStreamError)

package/src/routes/chat/streaming.ts

@@ -68,6 +68,7 @@ import {
 import {
   getIncrementalDelta,
   isThinkingPhase,
+  isAnswerPhase,
   extractThinkingContent,
   formatThinkingSummaryContent,
   shouldSuppressStreamAbort,
@@ -470,7 +471,7 @@ export async function processNonStreamingResponse(
                   foundStr = true;
                 }
               }
-            } else if (delta.phase === "answer") {
+            } else if (isAnswerPhase(delta.phase)) {
               isThinkingChunk = false;
               if (delta.content !== undefined) {
                 const newContent = delta.content || "";
@@ -1436,7 +1437,7 @@ export async function processStreamingResponse(
 
         if (
           switchAccount &&
-          (policy.accountCooldownMs || policy.accountCooldownReason)
+          (policy.accountCooldownMs ?? 0) > 0
         ) {
           markAccountRateLimited(
             currentAccountId,
@@ -1445,6 +1446,12 @@ export async function processStreamingResponse(
           );
         }
 
+        if (policy.accountCooldownReason === "AuthExpired") {
+          import("../../services/playwright.ts")
+            .then(({ refreshAccountToken }) => refreshAccountToken(currentAccountId))
+            .catch(() => {});
+        }
+
         retryContext.releaseAccountLease?.();
         retryContext.releaseAccountLease = null;
         await reader.cancel().catch(() => undefined);
@@ -1776,7 +1783,7 @@ export async function processStreamingResponse(
               // "phase":"answer"} delta and NO trailing [DONE]. Treat it as
               // the terminal event so we don't wait on the keep-alive
               // connection to close (up to the 60s/10min idle timeout).
-              if (delta.phase === "answer" && delta.status === "finished") {
+              if (isAnswerPhase(delta.phase) && delta.status === "finished") {
                 upstreamDone = true;
                 if (!clientDisconnected) flushWrites();
                 break; // Exit the for loop; the while check leaves the read loop
@@ -1800,7 +1807,7 @@ export async function processStreamingResponse(
                     foundStr = true;
                   }
                 }
-              } else if (delta.phase === "answer") {
+              } else if (isAnswerPhase(delta.phase)) {
                 isThinkingChunk = false;
                 if (delta.content !== undefined) {
                   const newContent = delta.content || "";
@@ -2290,7 +2297,7 @@ export async function processStreamingResponse(
               // The retry stream may also terminate with an answer-finished
               // delta when upstream sends no [DONE]. Leave the read loop
               // immediately so we don't stall on the keep-alive connection.
-              if (delta.phase === "answer" && delta.status === "finished") {
+              if (isAnswerPhase(delta.phase) && delta.status === "finished") {
                 upstreamDone = true;
                 break retryReadLoop;
               }

package/src/routes/upload.ts

@@ -387,15 +387,18 @@ async function getSTSToken(
     }
     data = await response.json().catch(() => null);
   }
+  const codeLower = (data?.data?.code || data?.code || "").toLowerCase();
+  const detailsLower = (typeof data?.data?.details === "string" ? data.data.details : typeof data?.message === "string" ? data.message : "").toLowerCase();
   const is401 =
     data?.success === false &&
-    (data?.data?.code === "Unauthorized" ||
-      (typeof data?.data?.details === "string" &&
-        data.data.details.includes("401")));
+    (codeLower === "unauthorized" ||
+      detailsLower.includes("401") ||
+      detailsLower.includes("token has expired") ||
+      detailsLower.includes("unauthorized"));
 
   if (is401) {
     try {
-      const { refreshHeaders } = await import("../services/playwright.ts");
+      const { refreshAccountToken } = await import("../services/playwright.ts");
       const { getBasicHeaders } = await import("../services/auth-playwright.ts");
       const { loadAccounts } = await import("../core/accounts.ts");
       const resolvedId = accountId ?? loadAccounts()[0]?.id;
@@ -403,16 +406,18 @@ async function getSTSToken(
         console.warn(
           `[Upload] STS token 401 — refreshing session with re-auth and retrying...`,
         );
-        await refreshHeaders(resolvedId, undefined, true);
-        const fresh = await getBasicHeaders(resolvedId);
-        headers.cookie = fresh.cookie;
-        headers["user-agent"] = fresh.userAgent;
-        headers["bx-v"] = fresh.bxV;
-        if (fresh.bxUa) headers["bx-ua"] = fresh.bxUa;
-        if (fresh.bxUmidtoken) headers["bx-umidtoken"] = fresh.bxUmidtoken;
-        const retryRes = await doFetch(headers);
-        if (retryRes.ok) {
-          data = await retryRes.json().catch(() => null);
+        const refreshResult = await refreshAccountToken(resolvedId);
+        if (refreshResult.success) {
+          const fresh = await getBasicHeaders(resolvedId);
+          headers.cookie = fresh.cookie;
+          headers["user-agent"] = fresh.userAgent;
+          headers["bx-v"] = fresh.bxV;
+          if (fresh.bxUa) headers["bx-ua"] = fresh.bxUa;
+          if (fresh.bxUmidtoken) headers["bx-umidtoken"] = fresh.bxUmidtoken;
+          const retryRes = await doFetch(headers);
+          if (retryRes.ok) {
+            data = await retryRes.json().catch(() => null);
+          }
         }
       }
     } catch (refreshErr) {

package/src/services/playwright.ts

@@ -2005,6 +2005,8 @@ export interface LoginAttemptResult {
   success: boolean;
   permanentFailure?: boolean;
   reason?: string;
+  token?: string;
+  refreshToken?: string;
 }
 
 export function classifyQwenAuthError(
@@ -2120,6 +2122,7 @@ async function loginToQwen(
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || undefined,
             version: cache.headers["version"] || undefined,
             tokenExpiresAt: exp || undefined,
+            refreshToken: apiResult.refreshToken,
             capturedAt: Date.now(),
           });
         }
@@ -2155,6 +2158,12 @@ async function loginToQwen(
           markAccountHeadersReady(accountId);
           const { saveAuthSession } = await import("../core/database.ts");
           const exp = parseJwtExpiry(tokenCookie.value);
+          let rTok = uiResult.refreshToken;
+          if (!rTok) {
+            try {
+              rTok = (await page.evaluate(() => localStorage.getItem("refresh_token") || "")) || undefined;
+            } catch {}
+          }
           saveAuthSession(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
@@ -2166,6 +2175,7 @@ async function loginToQwen(
             secChUaPlatform: cache.headers["sec-ch-ua-platform"] || undefined,
             version: cache.headers["version"] || undefined,
             tokenExpiresAt: exp || undefined,
+            refreshToken: rTok,
             capturedAt: Date.now(),
           });
         }
@@ -2384,7 +2394,7 @@ async function loginViaApi(
           )
           .catch(() => {});
         await page.reload({ waitUntil: "domcontentloaded" }).catch(() => {});
-        return { success: true };
+        return { success: true, token, refreshToken };
       }
     }
 
@@ -2690,6 +2700,161 @@ async function loginViaUi(
   }
 }
 
+/**
+ * Silently refresh the short-lived access token (15m) using the 30-day refresh_token.
+ * Uses official in-page fetch matching Qwen Web /api/v2/auths/refresh verified in HAR.
+ */
+export async function refreshAccountToken(
+  accountId: string,
+): Promise<{ success: boolean; token?: string; error?: string }> {
+  const page = accountPages.get(accountId);
+  if (!page || page.isClosed()) {
+    return { success: false, error: "Account page not active" };
+  }
+
+  // 1. Get refresh token from SQLite session or localStorage
+  const { getValidAuthSession, saveAuthSession } = await import("../core/database.ts");
+  const session = getValidAuthSession(accountId);
+  let refreshToken = session?.refreshToken;
+
+  if (!refreshToken) {
+    try {
+      refreshToken =
+        (await page.evaluate(() => localStorage.getItem("refresh_token") || "")) ||
+        undefined;
+    } catch {}
+  }
+
+  // 2. If we have a refresh token, invoke the working refresh endpoint in-page
+  if (refreshToken) {
+    try {
+      const refreshResult = await page.evaluate(
+        async ({ rTok }) => {
+          try {
+            const response = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+              method: "GET",
+              credentials: "include",
+              headers: {
+                accept: "application/json, text/plain, */*",
+                source: "web",
+                version: "0.3.11",
+                "x-request-origin": "https://chat.qwen.ai",
+                timezone: new Date().toString().split(" (")[0],
+                authorization: `Bearer ${rTok}`,
+              },
+            });
+            const json = await response.json().catch(() => null);
+            return { ok: response.ok, status: response.status, data: json };
+          } catch (e: any) {
+            return { ok: false, error: e.message };
+          }
+        },
+        { rTok: refreshToken },
+      );
+
+      const json = refreshResult?.data;
+      if (json && json.success === true && json.data) {
+        const newAccessToken = json.data.access_token || json.data.token;
+        const newRefreshToken = json.data.refresh_token || refreshToken;
+
+        if (newAccessToken) {
+          // Update browser cookie and localStorage
+          await page.context().addCookies([
+            {
+              name: "token",
+              value: newAccessToken,
+              domain: ".qwen.ai",
+              path: "/",
+              expires: Math.floor(Date.now() / 1000) + 31536000,
+              httpOnly: false,
+              secure: true,
+              sameSite: "Lax",
+            },
+          ]);
+
+          await page
+            .evaluate(
+              ({ tok, rTok }) => {
+                try {
+                  localStorage.removeItem("qwen_token_logged_out_marker");
+                  localStorage.setItem("token", tok);
+                  localStorage.setItem("access_token", tok);
+                  if (rTok) localStorage.setItem("refresh_token", rTok);
+                  document.cookie = `token=${encodeURIComponent(tok)}; path=/; domain=.qwen.ai; max-age=31536000`;
+                } catch {}
+              },
+              { tok: newAccessToken, rTok: newRefreshToken },
+            )
+            .catch(() => {});
+
+          // Update memory cache
+          const liveCookies = await page.context().cookies();
+          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+          const cache = getHeaderCache(accountId);
+          cache.headers.cookie = cookieStr;
+          cache.lastRefresh = Date.now();
+          markAccountHeadersReady(accountId);
+
+          // Update SQLite session with new tokens
+          saveAuthSession(accountId, {
+            cookie: cookieStr,
+            userAgent: cache.headers["user-agent"] || session?.userAgent || "",
+            bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
+            bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+            secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
+            secChUaMobile: cache.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+            secChUaPlatform: cache.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+            version: cache.headers["version"] || session?.version,
+            userId: session?.userId,
+            tokenExpiresAt: parseJwtExpiry(newAccessToken) || undefined,
+            refreshToken: newRefreshToken,
+            capturedAt: Date.now(),
+          });
+
+          return { success: true, token: newAccessToken };
+        }
+      }
+    } catch {}
+  }
+
+  // 3. Fallback: if refresh_token was invalid/absent or refresh failed, do clean API login
+  const { getAccountCredentials } = await import("../core/accounts.ts");
+  const creds = getAccountCredentials(accountId);
+  if (creds && creds.email && creds.password) {
+    const apiResult = await loginViaApi(page, creds.email, creds.password);
+    if (apiResult.success) {
+      const liveCookies = await page.context().cookies();
+      const tokenCookie = liveCookies.find((c) => c.name === "token");
+      if (tokenCookie) {
+        const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
+        const cache = getHeaderCache(accountId);
+        cache.headers.cookie = cookieStr;
+        cache.lastRefresh = Date.now();
+        markAccountHeadersReady(accountId);
+        saveAuthSession(accountId, {
+          cookie: cookieStr,
+          userAgent: cache.headers["user-agent"] || session?.userAgent || "",
+          bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
+          bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
+          secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
+          secChUaMobile: cache.headers["sec-ch-ua-mobile"] || session?.secChUaMobile,
+          secChUaPlatform: cache.headers["sec-ch-ua-platform"] || session?.secChUaPlatform,
+          version: cache.headers["version"] || session?.version,
+          userId: session?.userId,
+          tokenExpiresAt: parseJwtExpiry(tokenCookie.value) || undefined,
+          refreshToken: apiResult.refreshToken,
+          capturedAt: Date.now(),
+        });
+        return { success: true, token: tokenCookie.value };
+      }
+    }
+  }
+
+  return { success: false, error: "Could not refresh or re-authenticate token" };
+}
+
 // ─── Header Capture ───────────────────────────────────────────────────────────
 
 /**
@@ -3410,17 +3575,10 @@ async function refreshHeadersInternal(
       };
 
       if (forceReauth) {
-        // If the page is already logged in, do NOT execute destructive password re-login!
-        const alreadyIn = await isPageLoggedIn(page, 2000).catch(() => false);
-        if (alreadyIn) {
-          const liveCookies = await page.context().cookies();
-          if (liveCookies.some((c) => c.name === "token")) {
-            const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
-            cache.headers.cookie = cookieStr;
-            cache.lastRefresh = Date.now();
-            markAccountHeadersReady(accountId);
-            return;
-          }
+        // Try silent token refresh first using the 30-day refresh_token or direct API signin!
+        const refreshed = await refreshAccountToken(accountId);
+        if (refreshed.success) {
+          return;
         }
         await executeReauth();
       } else {
@@ -4019,53 +4177,17 @@ export async function keepAlivePlaywrightAccount(
     const now = Date.now();
     const currentUrl = page.url();
 
-    // Proactive session check: if token expires within 2 minutes, refresh in-page silently
+    // Proactive session check: if token expires within 5 minutes, refresh in-page silently using refreshAccountToken
     const cookie = await getCookies(accountId);
-    if (cookie && isTokenExpiringSoon(cookie, 2)) {
-      try {
-        await page
-          .evaluate(async () => {
-            await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
-              method: "GET",
-              credentials: "include",
-            }).catch(() => {});
-            await fetch("/api/v1/auths/", {
-              method: "GET",
-              credentials: "include",
-            }).catch(() => {});
-          })
-          .catch(() => {});
-
-        const liveCookies = await page.context().cookies();
-        const tokenCookie = liveCookies.find((c) => c.name === "token");
-        if (tokenCookie) {
-          const cookieStr = liveCookies.map((c) => `${c.name}=${c.value}`).join("; ");
-          const cache = getHeaderCache(accountId);
-          cache.headers.cookie = cookieStr;
-          cache.lastRefresh = Date.now();
-          markAccountHeadersReady(accountId);
-          lastKeepAliveNavigation.set(accountId, now);
-          touchAccountActivity(accountId);
-          return true;
-        }
-      } catch {}
-
-      // If token refresh probe didn't restore cookies and the page is genuinely logged out:
-      const loggedIn = await isPageLoggedIn(page, 2000).catch(() => false);
-      if (!loggedIn) {
-        console.log(
-          `💓 [SessionKeeper] Account ${accountId} session expired; renewing session...`,
-        );
-        try {
-          await refreshHeadersInternal(accountId, config.timeouts.headers, true);
-          lastKeepAliveNavigation.set(accountId, now);
-          touchAccountActivity(accountId);
-          return true;
-        } catch (err) {
-          console.warn(
-            `[SessionKeeper] Proactive session renewal failed for ${accountId}: ${getErrorMessage(err)}`,
-          );
-        }
+    if (cookie && isTokenExpiringSoon(cookie, 5)) {
+      console.log(
+        `💓 [SessionKeeper] Account ${accountId} access token expiring soon (<5m); silently refreshing...`,
+      );
+      const res = await refreshAccountToken(accountId);
+      if (res.success) {
+        lastKeepAliveNavigation.set(accountId, now);
+        touchAccountActivity(accountId);
+        return true;
       }
     }
 

package/src/services/qwen-chat-pool.ts

@@ -71,12 +71,25 @@ async function createQwenChatSession(
       } catch {}
     }
 
-    if (
-      json?.data?.code === "Unauthorized" ||
-      json?.code === "Unauthorized" ||
+    const isUnauthorized =
+      json?.data?.code?.toLowerCase() === "unauthorized" ||
+      json?.code?.toLowerCase() === "unauthorized" ||
       rawLower.includes("unauthorized") ||
-      rawLower.includes("permission to access")
-    ) {
+      rawLower.includes("permission to access") ||
+      rawLower.includes("token has expired") ||
+      rawLower.includes("401");
+
+    if (isUnauthorized) {
+      if (accountId) {
+        try {
+          const { refreshAccountToken } = await import("./playwright.ts");
+          const refreshed = await refreshAccountToken(accountId);
+          if (refreshed.success) {
+            const { headers: freshHeaders } = await getQwenHeaders(false, accountId);
+            return createQwenChatSession(freshHeaders, model, accountId, chatMode);
+          }
+        } catch {}
+      }
       throw new QwenUpstreamError(
         `Qwen create chat unauthorized: ${raw.substring(0, 300)}`,
         "Unauthorized",

package/src/services/qwen-headers.ts

@@ -79,7 +79,8 @@ export function buildQwenRequestHeaders(
     "bx-v": opts.bxV || "2.5.37",
     source: "web",
     version: opts.version || getQwenWebVersion(),
-    timezone: opts.extra?.timezone || new Date().toString().split(" (")[0],
+    timezone: opts.extra?.timezone || opts.extra?.Timezone || new Date().toString().split(" (")[0],
+    Timezone: opts.extra?.Timezone || opts.extra?.timezone || new Date().toString().split(" (")[0],
     // Use the real browser client-hints when captured (anti-hardcoded); fall
     // back to the static fingerprint otherwise.
     "sec-ch-ua":

package/src/services/qwen.ts

@@ -929,16 +929,28 @@ export async function requestQwenTextInBrowser(
           // If 401 Unauthorized in browser, try silent in-page token refresh before giving up
           if (response.status === 401) {
             try {
-              const refreshRes = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
-                method: "GET",
-                credentials: "include",
-                signal: AbortSignal.timeout(3000),
-              });
-              if (refreshRes.status === 200) {
+              const rTok = localStorage.getItem("refresh_token");
+              if (rTok) {
+                const refreshRes = await fetch("https://auth.qwen.ai/api/v2/auths/refresh", {
+                  method: "GET",
+                  credentials: "include",
+                  headers: {
+                    accept: "application/json, text/plain, */*",
+                    source: "web",
+                    version: "0.3.11",
+                    "x-request-origin": "https://chat.qwen.ai",
+                    timezone: new Date().toString().split(" (")[0],
+                    authorization: `Bearer ${rTok}`,
+                  },
+                  signal: AbortSignal.timeout(5000),
+                });
                 const refreshJson: any = await refreshRes.json().catch(() => null);
-                if (refreshJson && refreshJson.success === true && refreshJson.data?.token) {
-                  const freshTok = refreshJson.data.token;
+                const freshTok = refreshJson?.data?.access_token || refreshJson?.data?.token;
+                const nextRTok = refreshJson?.data?.refresh_token;
+                if (refreshJson?.success === true && freshTok) {
                   localStorage.setItem("token", freshTok);
+                  localStorage.setItem("access_token", freshTok);
+                  if (nextRTok) localStorage.setItem("refresh_token", nextRTok);
                   document.cookie = `token=${encodeURIComponent(freshTok)}; path=/; domain=.qwen.ai; max-age=31536000`;
                   if (headers["authorization"] || headers["Authorization"]) {
                     headers["authorization"] = `Bearer ${freshTok}`;
@@ -979,7 +991,7 @@ export async function requestQwenTextInBrowser(
   // Settings and personalization requests run as same-origin in-browser fetch
   // with appropriate Referer, keeping the page on the stable chat UI without
   // expensive page.goto navigations that can time out under load.
-  const response = await withQwenBrowserPage<BrowserTextResponse>(
+  let response = await withQwenBrowserPage<BrowserTextResponse>(
     accountId,
     evaluateRequest,
     undefined,
@@ -987,6 +999,23 @@ export async function requestQwenTextInBrowser(
     recoverOnTimeout,
   );
 
+  // If evaluateRequest still received 401, trigger outer token refresh and retry once
+  if (response.status === 401 && accountId) {
+    try {
+      const { refreshAccountToken } = await import("./playwright.ts");
+      const refreshed = await refreshAccountToken(accountId);
+      if (refreshed.success) {
+        response = await withQwenBrowserPage<BrowserTextResponse>(
+          accountId,
+          evaluateRequest,
+          undefined,
+          options.timeoutMs,
+          recoverOnTimeout,
+        );
+      }
+    } catch {}
+  }
+
   return new Response(response.raw, {
     status: response.status,
     headers: response.contentType
@@ -1714,7 +1743,11 @@ export async function syncQwenRequestPersonalization(
     );
     try {
       currentSettings = null;
-      const { headers: freshHeaders } = await getQwenHeaders(true, accountId, true);
+      const { refreshAccountToken } = await import("./playwright.ts");
+      if (accountId) {
+        await refreshAccountToken(accountId);
+      }
+      const { headers: freshHeaders } = await getQwenHeaders(false, accountId);
       requestHeaders = buildCapturedQwenHeaders(freshHeaders, {
         referer: qwenUrl("/settings/personalization"),
       });
@@ -2730,10 +2763,19 @@ async function createQwenStreamInternal(
   };
 
   // A new logical chat session should reuse the warmed header cache when available.
-  // Header recapture is much more expensive and should be reserved for real refresh/login cases,
-  // not for ordinary first prompts that simply need parent_id reset.
+  // Proactively check if the access token is expiring soon (<3m) and refresh quietly before starting.
+  let forceRefresh = options?.forceNewChat === true;
+  if (!forceRefresh && accountId) {
+    try {
+      const basic = await getBasicHeaders(accountId);
+      if (isTokenExpiringSoon(basic.cookie, 3)) {
+        forceRefresh = true;
+      }
+    } catch {}
+  }
+
   const captured = await getQwenHeaders(
-    options?.forceNewChat === true,
+    forceRefresh,
     accountId,
   );
   ensureNotAborted();
@@ -2749,7 +2791,7 @@ async function createQwenStreamInternal(
   if (options && "chatSessionId" in options) {
     if (options.chatSessionId === null || options.chatSessionId === "") {
       const acquired = await acquireNewQwenChatSession(
-        headers,
+        activeHeaders,
         model,
         accountId,
         options?.chatMode ?? "thread",
@@ -2757,6 +2799,10 @@ async function createQwenStreamInternal(
       chatSessionId = acquired.chatId;
       leasedWarmChat = acquired.leasedFromPool;
       createdNewChat = true;
+      try {
+        const fresh = await getQwenHeaders(false, accountId);
+        activeHeaders = fresh.headers;
+      } catch {}
     } else {
       chatSessionId = options.chatSessionId;
     }
@@ -2764,7 +2810,7 @@ async function createQwenStreamInternal(
     chatSessionId = captured.chatSessionId;
     if (!chatSessionId) {
       const acquired = await acquireNewQwenChatSession(
-        headers,
+        activeHeaders,
         model,
         accountId,
         options?.chatMode ?? "thread",
@@ -2772,6 +2818,10 @@ async function createQwenStreamInternal(
       chatSessionId = acquired.chatId;
       leasedWarmChat = acquired.leasedFromPool;
       createdNewChat = true;
+      try {
+        const fresh = await getQwenHeaders(false, accountId);
+        activeHeaders = fresh.headers;
+      } catch {}
     }
   }