qwenproxy-cli 1.6.0 → 1.6.2

package/dist/login.js

@@ -826,7 +826,7 @@ function addAccountsBatch(entries) {
   }
   return { added, skipped, invalid };
 }
-function addAccount(email, password, id) {
+function addAccount(email, password = "", id) {
   if (!email || typeof email !== "string" || email.trim().length === 0) {
     throw new Error("Email is required");
   }
@@ -1102,6 +1102,44 @@ var init_logger = __esm({
   }
 });
 
+// src/core/process-guard.ts
+function isPlaywrightAlreadyClosedMessage(message) {
+  if (!message) return false;
+  return message.includes("Target page, context or browser has been closed") || message.includes("Browser has been closed") || message.includes("Target closed") || message.includes("Target crashed") || message.includes("Page crashed") || message.includes("Assertion error") || message.includes("Cannot find parent object") || message.includes("Connection closed") || message.includes("session closed") || message.includes("Session closed") || message.includes("Network.setCacheDisabled") || message.includes("Protocol error") || message.includes("storageState timed out");
+}
+function isBenignTeardownError(error) {
+  if (!error) return false;
+  const message = error instanceof Error ? error.message : typeof error === "object" && "message" in error ? String(error.message) : String(error);
+  return isPlaywrightAlreadyClosedMessage(message);
+}
+function installProcessTeardownGuards(label = "Process") {
+  if (guardsInstalled) return;
+  guardsInstalled = true;
+  process.on("uncaughtException", (error) => {
+    if (isBenignTeardownError(error)) {
+      const msg = error instanceof Error ? error.message : typeof error === "object" && error !== null && "message" in error ? String(error.message) : String(error);
+      console.warn(`\u26A0\uFE0F  [${label}] Handled benign driver teardown exception: ${msg}`);
+      return;
+    }
+    console.error(`\u274C [${label}] Uncaught Exception:`, error);
+  });
+  process.on("unhandledRejection", (reason) => {
+    if (isBenignTeardownError(reason)) {
+      const msg = reason instanceof Error ? reason.message : typeof reason === "object" && reason !== null && "message" in reason ? String(reason.message) : String(reason);
+      console.warn(`\u26A0\uFE0F  [${label}] Handled benign driver teardown rejection: ${msg}`);
+      return;
+    }
+    console.error(`\u274C [${label}] Unhandled Rejection:`, reason);
+  });
+}
+var guardsInstalled;
+var init_process_guard = __esm({
+  "src/core/process-guard.ts"() {
+    "use strict";
+    guardsInstalled = false;
+  }
+});
+
 // src/core/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -1251,11 +1289,11 @@ var init_config = __esm({
       // nothing in this window is dead and should fail fast, retryable).
       QWEN_FIRST_CHUNK_TIMEOUT: z.string().default("60000"),
       TOTAL_REQUEST_TIMEOUT: z.string().default("600000"),
-      // Mid-stream silence window for thinking models: 3 min with ZERO upstream
+      // Mid-stream silence window for thinking models: 5 min with ZERO upstream
       // bytes is a dead stream (WAF swallow / dropped connection) — fail fast and
       // let the retry policy rotate accounts. Flowing reasoning chunks RESET this
       // timer, so legitimate slow thinking is never cut; only total silence is.
-      REASONING_MODEL_TIMEOUT: z.string().default("180000"),
+      REASONING_MODEL_TIMEOUT: z.string().default("300000"),
       CACHE_TTL: z.string().default("3600"),
       RESPONSE_TTL: z.string().default("1800"),
       CACHE_COMPRESSION_ENABLED: z.string().default("true"),
@@ -3127,6 +3165,8 @@ var init_clean_cache = __esm({
   "src/clean-cache.ts"() {
     "use strict";
     init_playwright();
+    init_process_guard();
+    installProcessTeardownGuards("CleanCache");
     isDirectRun = process.argv[1] && (process.argv[1].endsWith("clean-cache.ts") || process.argv[1].endsWith("clean-cache.js"));
     if (isDirectRun) {
       main().catch((err) => {
@@ -3142,6 +3182,7 @@ var playwright_exports = {};
 __export(playwright_exports, {
   assertAntiBotHeaders: () => assertAntiBotHeaders,
   buildChromiumLaunchArgs: () => buildChromiumLaunchArgs,
+  cancelEmailOtpLogin: () => cancelEmailOtpLogin,
   captureQwenHeaders: () => captureQwenHeaders,
   classifyQwenAuthError: () => classifyQwenAuthError,
   cleanupOrphanProfiles: () => cleanupOrphanProfiles,
@@ -3182,8 +3223,10 @@ __export(playwright_exports, {
   removePlaywrightProfile: () => removePlaywrightProfile,
   saveStorageState: () => saveStorageState,
   schedulePlaywrightProfileReset: () => schedulePlaywrightProfileReset,
+  startEmailOtpLogin: () => startEmailOtpLogin,
   unregisterPlaywrightAccountForTests: () => unregisterPlaywrightAccountForTests,
   validateAccountLogin: () => validateAccountLogin,
+  verifyEmailOtpLogin: () => verifyEmailOtpLogin,
   withAccountPage: () => withAccountPage
 });
 import { chromium as chromium2 } from "patchright";
@@ -3351,15 +3394,18 @@ function loadStorageState(accountId) {
     return void 0;
   }
 }
-async function saveStorageState(context, accountId, timeoutMs = 5e3) {
+async function saveStorageState(context, accountId, timeoutMs = 1e4) {
   try {
     const stateFile = getStorageStatePath(accountId);
     const dir = path5.dirname(stateFile);
     if (!fs8.existsSync(dir)) {
       fs8.mkdirSync(dir, { recursive: true });
     }
+    const rawPromise = context.storageState({ path: stateFile }).catch(() => {
+      return void 0;
+    });
     await withTimeout(
-      context.storageState({ path: stateFile }),
+      rawPromise,
       timeoutMs,
       `storageState timed out after ${timeoutMs}ms`
     );
@@ -3522,6 +3568,10 @@ async function clearVisibleChallenge(page) {
       "button[aria-label*='Close' i]",
       "button[aria-label*='Fechar' i]",
       ".index-module__whats-new-modal-close",
+      ".age-confirmation-modal button",
+      ".age-confirmation-modal .qwen-chat-v2-btn-black",
+      "button:has-text('Continuar')",
+      "button:has-text('Continue')",
       "button:has-text('Cancel')",
       "button:has-text('Cancelar')",
       "button:has-text('I understand')",
@@ -4716,6 +4766,292 @@ async function validateAccountLogin(rawAccount, headless = true, browserType = "
     release();
   }
 }
+async function startEmailOtpLogin(email, options = {}) {
+  const normalizedEmail = email.trim().toLowerCase();
+  if (!normalizedEmail || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalizedEmail)) {
+    return { success: false, error: "Formato de e-mail inv\xE1lido" };
+  }
+  const { listAccounts: listAccounts2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+  if (listAccounts2().some((a) => a.email.toLowerCase() === normalizedEmail)) {
+    return {
+      success: false,
+      error: `Uma conta com o e-mail "${normalizedEmail}" j\xE1 est\xE1 cadastrada.`
+    };
+  }
+  if (process.env.TEST_MOCK_QWEN_AUTH === "true" && process.env.NODE_ENV !== "production") {
+    const mockSessionId = "mock-otp-" + Date.now();
+    mockOtpSessions.set(mockSessionId, normalizedEmail);
+    return { success: true, sessionId: mockSessionId };
+  }
+  const accountId = crypto3.randomUUID();
+  const sessionId = accountId;
+  const profilePath = getAccountProfilePath(accountId);
+  const fingerprint = getFingerprintProfile(accountId);
+  const browserType = options.browserType ?? config.playwright.browser;
+  const { engine, channel } = resolveBrowserEngine(browserType);
+  const headless = options.headless ?? config.playwright.headless;
+  const launchOptions = {
+    headless,
+    channel,
+    userAgent: fingerprint.userAgent,
+    locale: fingerprint.locale,
+    timezoneId: fingerprint.timezoneId,
+    viewport: fingerprint.viewport,
+    screen: fingerprint.viewport,
+    deviceScaleFactor: 1,
+    isMobile: false,
+    hasTouch: false,
+    colorScheme: "light",
+    extraHTTPHeaders: {
+      "sec-ch-ua": fingerprint.secChUa,
+      "sec-ch-ua-mobile": "?0",
+      "sec-ch-ua-platform": '"Windows"'
+    },
+    ignoreDefaultArgs: ["--enable-automation", "--enable-blink-features"],
+    args: buildChromiumLaunchArgs(fingerprint.viewport)
+  };
+  let acctContext;
+  try {
+    acctContext = await withTimeout(
+      engine.launchPersistentContext(profilePath, launchOptions),
+      3e4,
+      `O navegador n\xE3o iniciou em 30s para a conta ${maskEmail(normalizedEmail)}.`
+    );
+  } catch (launchErr) {
+    if (launchErr?.message?.includes("Executable doesn't exist")) {
+      autoInstallPlaywrightChromium();
+      acctContext = await withTimeout(
+        engine.launchPersistentContext(profilePath, launchOptions),
+        3e4,
+        `O navegador n\xE3o iniciou em 30s para a conta ${maskEmail(normalizedEmail)}.`
+      );
+    } else {
+      return { success: false, error: launchErr?.message || String(launchErr) };
+    }
+  }
+  try {
+    await acctContext.addInitScript(getStealthScript(fingerprint));
+    const existingPages = acctContext.pages().filter((p) => !p.isClosed());
+    const acctPage = existingPages.find((p) => p.url().startsWith(qwenOrigin())) ?? existingPages[0] ?? await acctContext.newPage();
+    await acctPage.goto(qwenUrl("/auth?mode=register"), {
+      waitUntil: "domcontentloaded",
+      timeout: Math.min(config.timeouts.navigation, 2e4)
+    }).catch(() => {
+    });
+    await sleep2(1e3);
+    await clearVisibleChallenge(acctPage);
+    const requestId = crypto3.randomUUID();
+    const evalRes = await acctPage.evaluate(
+      async ({ email: email2, requestId: requestId2, version, timezone }) => {
+        try {
+          const response = await fetch("https://auth.qwen.ai/api/v2/auths/otp/email/request", {
+            method: "POST",
+            credentials: "include",
+            headers: {
+              accept: "application/json, text/plain, */*",
+              "content-type": "application/json",
+              source: "web",
+              version,
+              "x-request-origin": "https://chat.qwen.ai",
+              timezone,
+              "x-request-id": requestId2
+            },
+            body: JSON.stringify({
+              identifier: email2,
+              accept_terms: true,
+              language: "pt-BR"
+            })
+          });
+          const json = await response.json().catch(() => null);
+          return { ok: response.ok, status: response.status, data: json };
+        } catch (e) {
+          return { ok: false, error: e.message };
+        }
+      },
+      {
+        email: normalizedEmail,
+        requestId,
+        version: getQwenWebVersion() || "0.3.12",
+        timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0]
+      }
+    ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
+    if (!evalRes.ok || evalRes.data?.success !== true) {
+      const errorMsg = evalRes.data?.data?.details || evalRes.data?.data?.message || evalRes.data?.message || evalRes.error || "Falha ao solicitar c\xF3digo de verifica\xE7\xE3o";
+      await closePlaywrightContextBestEffort(accountId, acctContext).catch(() => {
+      });
+      cleanupPlaywrightAccountState(accountId);
+      return { success: false, error: errorMsg };
+    }
+    const timer = setTimeout(async () => {
+      activeOtpSessions.delete(sessionId);
+      await closePlaywrightContextBestEffort(accountId, acctContext).catch(() => {
+      });
+      cleanupPlaywrightAccountState(accountId);
+    }, 5 * 60 * 1e3);
+    timer.unref?.();
+    activeOtpSessions.set(sessionId, {
+      sessionId,
+      accountId,
+      email: normalizedEmail,
+      context: acctContext,
+      page: acctPage,
+      fingerprint,
+      createdAt: Date.now(),
+      timer
+    });
+    return { success: true, sessionId };
+  } catch (err) {
+    await closePlaywrightContextBestEffort(accountId, acctContext).catch(() => {
+    });
+    cleanupPlaywrightAccountState(accountId);
+    return { success: false, error: err?.message || String(err) };
+  }
+}
+async function verifyEmailOtpLogin(sessionId, code) {
+  const cleanCode = code.trim();
+  if (!cleanCode) {
+    return { success: false, error: "C\xF3digo de verifica\xE7\xE3o \xE9 obrigat\xF3rio" };
+  }
+  if (process.env.TEST_MOCK_QWEN_AUTH === "true" && process.env.NODE_ENV !== "production") {
+    const mockEmail = mockOtpSessions.get(sessionId);
+    if (!mockEmail) {
+      return { success: false, error: "Sess\xE3o OTP inv\xE1lida ou expirada" };
+    }
+    if (cleanCode === "000000") {
+      return { success: false, error: "C\xF3digo de verifica\xE7\xE3o incorreto ou expirado" };
+    }
+    const { addAccount: addAccount2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+    const mockAccId = "mock-otp-acc-" + Date.now();
+    const newAccount = addAccount2(mockEmail, "", mockAccId);
+    mockOtpSessions.delete(sessionId);
+    return { success: true, account: newAccount };
+  }
+  const session = activeOtpSessions.get(sessionId);
+  if (!session) {
+    return { success: false, error: "Sess\xE3o OTP expirada ou n\xE3o encontrada. Solicite um novo c\xF3digo." };
+  }
+  if (session.page.isClosed()) {
+    activeOtpSessions.delete(sessionId);
+    return { success: false, error: "Navegador foi fechado. Solicite um novo c\xF3digo." };
+  }
+  const requestId = crypto3.randomUUID();
+  const evalRes = await session.page.evaluate(
+    async ({ email, code: code2, requestId: requestId2, version, timezone }) => {
+      try {
+        const response = await fetch("https://auth.qwen.ai/api/v2/auths/otp/email/verify", {
+          method: "POST",
+          credentials: "include",
+          headers: {
+            accept: "application/json, text/plain, */*",
+            "content-type": "application/json",
+            source: "web",
+            version,
+            "x-request-origin": "https://chat.qwen.ai",
+            timezone,
+            "x-request-id": requestId2
+          },
+          body: JSON.stringify({
+            identifier: email,
+            code: code2,
+            name: null
+          })
+        });
+        const json = await response.json().catch(() => null);
+        return { ok: response.ok, status: response.status, data: json };
+      } catch (e) {
+        return { ok: false, error: e.message };
+      }
+    },
+    {
+      email: session.email,
+      code: cleanCode,
+      requestId,
+      version: getQwenWebVersion() || "0.3.12",
+      timezone: (/* @__PURE__ */ new Date()).toString().split(" (")[0]
+    }
+  ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
+  if (!evalRes.ok || evalRes.data?.success !== true || !evalRes.data?.data) {
+    const errorMsg = evalRes.data?.data?.details || evalRes.data?.data?.message || evalRes.data?.message || evalRes.error || "C\xF3digo de verifica\xE7\xE3o incorreto ou expirado";
+    return { success: false, error: errorMsg };
+  }
+  const resData = evalRes.data.data;
+  const accessToken = resData.access_token || resData.token;
+  const refreshToken = resData.refresh_token;
+  const userId = resData.id;
+  try {
+    await session.page.evaluate(({ token, rTok }) => {
+      try {
+        localStorage.setItem("token", token);
+        localStorage.setItem("access_token", token);
+        if (rTok) localStorage.setItem("refresh_token", rTok);
+        document.cookie = `token=${encodeURIComponent(token)}; path=/; domain=.qwen.ai; max-age=31536000`;
+      } catch {
+      }
+    }, { token: accessToken, rTok: refreshToken });
+    await session.context.addCookies([
+      {
+        name: "token",
+        value: accessToken,
+        domain: ".qwen.ai",
+        path: "/",
+        expires: Math.floor(Date.now() / 1e3) + 31536e3,
+        httpOnly: false,
+        secure: true,
+        sameSite: "Lax"
+      }
+    ]);
+    await session.page.goto(qwenUrl("/"), {
+      waitUntil: "domcontentloaded",
+      timeout: Math.min(config.timeouts.navigation, 15e3)
+    }).catch(() => {
+    });
+    await sleep2(1e3);
+    await saveStorageState(session.context, session.accountId);
+    const { saveAuthSession: saveAuthSession2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+    const { parseJwtExpiry: parseJwtExpiry2 } = await Promise.resolve().then(() => (init_jwt(), jwt_exports));
+    const exp = parseJwtExpiry2(accessToken);
+    saveAuthSession2(session.accountId, {
+      cookie: `token=${accessToken}`,
+      userAgent: session.fingerprint.userAgent,
+      bxV: "2.5.37",
+      version: getQwenWebVersion() || "0.3.12",
+      userId: userId || void 0,
+      tokenExpiresAt: exp || void 0,
+      refreshToken: refreshToken || void 0,
+      capturedAt: Date.now()
+    });
+    const { addAccount: addAccount2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+    const newAccount = addAccount2(session.email, "", session.accountId);
+    clearTimeout(session.timer);
+    activeOtpSessions.delete(sessionId);
+    await closePlaywrightContextBestEffort(session.accountId, session.context).catch(() => {
+    });
+    cleanupPlaywrightAccountState(session.accountId);
+    return { success: true, account: newAccount };
+  } catch (err) {
+    clearTimeout(session.timer);
+    activeOtpSessions.delete(sessionId);
+    await closePlaywrightContextBestEffort(session.accountId, session.context).catch(() => {
+    });
+    cleanupPlaywrightAccountState(session.accountId);
+    return { success: false, error: err?.message || String(err) };
+  }
+}
+async function cancelEmailOtpLogin(sessionId) {
+  if (process.env.TEST_MOCK_QWEN_AUTH === "true" && process.env.NODE_ENV !== "production") {
+    mockOtpSessions.delete(sessionId);
+    return;
+  }
+  const session = activeOtpSessions.get(sessionId);
+  if (!session) return;
+  clearTimeout(session.timer);
+  activeOtpSessions.delete(sessionId);
+  await closePlaywrightContextBestEffort(session.accountId, session.context).catch(() => {
+  });
+  cleanupPlaywrightAccountState(session.accountId);
+  const { wipeAccountSessionFiles: wipeAccountSessionFiles2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+  wipeAccountSessionFiles2(session.accountId);
+}
 function classifyQwenAuthError(code, details) {
   const c = (code || "").trim().toLowerCase();
   const d = (details || "").trim().toLowerCase();
@@ -6084,7 +6420,7 @@ async function withAccountPage(accountId, fn, timeoutMs = ACCOUNT_PAGE_OPERATION
       return result;
     } catch (error) {
       const message = getErrorMessage(error);
-      if (recoverOnTimeout && message.includes("Playwright page operation timed out")) {
+      if (recoverOnTimeout && message.includes("Playwright page operation timed out") && (!page || page.isClosed())) {
         console.warn(
           `\u23F1\uFE0F  [Playwright] Resetting account context after a stuck page operation: ${accountId}`
         );
@@ -6633,7 +6969,7 @@ async function getTokenDiagnostics(accountId) {
     }
   };
 }
-var requireLocal, contextInitHooks, ACCOUNT_MUTEX_MAX_HOLD_MS, accountMutexes, accountContexts, accountPages, cachedUserAgents, inFlightAccountInits, sharedBrowser, sharedBrowserPromise, headerCaches, HEADER_CACHE_TTL, HEADER_REFRESH_THRESHOLD, COOKIE_CACHE_TTL, cookieCaches, lastAccountActivity, lastKeepAliveNavigation, lastProactiveTokenRefresh, profileResetQueue, profileResetChain, closingAllPlaywright, sleep2, HEADER_CAPTURE_SETTLE_MS, PLAYWRIGHT_MUTEX_WAIT_MS, ACCOUNT_PAGE_OPERATION_TIMEOUT_MS, SESSION_PROBE_NAVIGATION_TIMEOUT_MS, HEADER_CAPTURE_TRIGGER_GRACE_MS, FIRST_TRIGGER_GRACE_MS, HEADER_CAPTURE_TRIGGER_ATTEMPTS, CHAT_INPUT_APPEAR_TIMEOUT_MS, CHAT_INPUT_ACTION_TIMEOUT_MS, PROFILE_RESET_TIMEOUT_MS;
+var requireLocal, contextInitHooks, ACCOUNT_MUTEX_MAX_HOLD_MS, accountMutexes, accountContexts, accountPages, cachedUserAgents, inFlightAccountInits, sharedBrowser, sharedBrowserPromise, headerCaches, HEADER_CACHE_TTL, HEADER_REFRESH_THRESHOLD, COOKIE_CACHE_TTL, cookieCaches, lastAccountActivity, lastKeepAliveNavigation, lastProactiveTokenRefresh, profileResetQueue, profileResetChain, closingAllPlaywright, sleep2, HEADER_CAPTURE_SETTLE_MS, PLAYWRIGHT_MUTEX_WAIT_MS, ACCOUNT_PAGE_OPERATION_TIMEOUT_MS, SESSION_PROBE_NAVIGATION_TIMEOUT_MS, HEADER_CAPTURE_TRIGGER_GRACE_MS, FIRST_TRIGGER_GRACE_MS, HEADER_CAPTURE_TRIGGER_ATTEMPTS, CHAT_INPUT_APPEAR_TIMEOUT_MS, CHAT_INPUT_ACTION_TIMEOUT_MS, activeOtpSessions, mockOtpSessions, PROFILE_RESET_TIMEOUT_MS;
 var init_playwright = __esm({
   "src/services/playwright.ts"() {
     "use strict";
@@ -6678,11 +7014,13 @@ var init_playwright = __esm({
     PLAYWRIGHT_MUTEX_WAIT_MS = 6e4;
     ACCOUNT_PAGE_OPERATION_TIMEOUT_MS = config.timeouts.page;
     SESSION_PROBE_NAVIGATION_TIMEOUT_MS = 15e3;
-    HEADER_CAPTURE_TRIGGER_GRACE_MS = 15e3;
-    FIRST_TRIGGER_GRACE_MS = 8e3;
+    HEADER_CAPTURE_TRIGGER_GRACE_MS = 2e4;
+    FIRST_TRIGGER_GRACE_MS = 12e3;
     HEADER_CAPTURE_TRIGGER_ATTEMPTS = 3;
     CHAT_INPUT_APPEAR_TIMEOUT_MS = 15e3;
     CHAT_INPUT_ACTION_TIMEOUT_MS = 1e4;
+    activeOtpSessions = /* @__PURE__ */ new Map();
+    mockOtpSessions = /* @__PURE__ */ new Map();
     PROFILE_RESET_TIMEOUT_MS = Math.max(9e4, config.timeouts.headers);
     setWafContextResetListener((accountId) => {
       if (!accountPages.has(accountId)) return;
@@ -6698,10 +7036,12 @@ var init_playwright = __esm({
 // src/login.ts
 init_accounts();
 init_logger();
+init_process_guard();
 import crypto4 from "crypto";
 import * as readline from "readline";
 import * as dotenv2 from "dotenv";
 dotenv2.config();
+installProcessTeardownGuards("Login");
 var rl = readline.createInterface({
   input: process.stdin,
   output: process.stdout
@@ -6734,7 +7074,8 @@ async function showMenu() {
       console.log("No accounts configured yet.\n");
     }
     console.log("\nOptions:");
-    console.log("  [A] Add account");
+    console.log("  [A] Add account (Password)");
+    console.log("  [O] Add account (Passwordless / Email OTP)");
     if (accounts.length > 0) {
       console.log("  [R] Remove an account");
     }
@@ -6745,7 +7086,21 @@ async function showMenu() {
       process.exit(0);
     }
     if (choice === "A") {
-      await addAccountFlow();
+      clear();
+      console.log("=== Add New Account ===\n");
+      console.log("Authentication method:");
+      console.log("  [1] Traditional Password (Email + Password)");
+      console.log("  [2] Passwordless (Email Verification Code / OTP)\n");
+      const method = (await askQuestion("Select method [1/2] (default 1): ")).trim();
+      if (method === "2") {
+        await addAccountOtpFlow();
+      } else {
+        await addAccountPasswordFlow();
+      }
+      continue;
+    }
+    if (choice === "O") {
+      await addAccountOtpFlow();
       continue;
     }
     if (choice === "R" && accounts.length > 0) {
@@ -6754,9 +7109,9 @@ async function showMenu() {
     }
   }
 }
-async function addAccountFlow() {
+async function addAccountPasswordFlow() {
   clear();
-  console.log("=== Add New Account ===\n");
+  console.log("=== Add New Account (Password Login) ===\n");
   const email = await askQuestion("Email: ");
   if (!email || !email.trim()) {
     console.log("Email is required.");
@@ -6825,6 +7180,70 @@ async function addAccountFlow() {
   }
   await askQuestion("\nPress Enter to continue...");
 }
+async function addAccountOtpFlow() {
+  clear();
+  console.log("=== Add New Account (Passwordless / Email OTP) ===\n");
+  const email = await askQuestion("Email: ");
+  if (!email || !email.trim()) {
+    console.log("Email is required.");
+    await askQuestion("Press Enter to continue...");
+    return;
+  }
+  const trimmedEmail = email.trim();
+  const existingAccounts = listAccounts();
+  if (existingAccounts.some(
+    (a) => a.email.toLowerCase() === trimmedEmail.toLowerCase()
+  )) {
+    console.log(
+      `
+\u274C Error: An account with email "${trimmedEmail}" already exists.`
+    );
+    await askQuestion("Press Enter to continue...");
+    return;
+  }
+  console.log(
+    `
+\u23F3 Requesting OTP verification code for ${maskEmail(trimmedEmail)}...`
+  );
+  const { startEmailOtpLogin: startEmailOtpLogin2, verifyEmailOtpLogin: verifyEmailOtpLogin2, cancelEmailOtpLogin: cancelEmailOtpLogin2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+  const startRes = await startEmailOtpLogin2(trimmedEmail, { headless: false });
+  if (!startRes.success || !startRes.sessionId) {
+    console.log(
+      `
+\u274C Failed to request code: ${startRes.error || "Unknown error"}`
+    );
+    await askQuestion("Press Enter to continue...");
+    return;
+  }
+  console.log(`
+\u2709\uFE0F  Verification code sent to ${trimmedEmail}!`);
+  console.log("Check your email inbox (and spam folder).\n");
+  while (true) {
+    const code = await askQuestion("Enter 6-digit code (or 'C' to cancel): ");
+    if (!code || !code.trim()) continue;
+    if (code.trim().toUpperCase() === "C") {
+      await cancelEmailOtpLogin2(startRes.sessionId);
+      console.log("\nLogin cancelled.");
+      await askQuestion("Press Enter to continue...");
+      return;
+    }
+    console.log("\n\u23F3 Verifying code and establishing 30-day session...");
+    const verifyRes = await verifyEmailOtpLogin2(startRes.sessionId, code.trim());
+    if (verifyRes.success && verifyRes.account) {
+      console.log(
+        `
+\u2705 Account verified and saved: ${maskEmail(verifyRes.account.email)} (${verifyRes.account.id})`
+      );
+      console.log("Passwordless 30-day session active.");
+      await askQuestion("\nPress Enter to continue...");
+      return;
+    } else {
+      console.log(`
+\u274C ${verifyRes.error || "Invalid code"}`);
+      console.log("Please try again or enter 'C' to cancel.\n");
+    }
+  }
+}
 async function removeAccountFlow() {
   const accounts = listAccounts();
   if (accounts.length === 0) return;