qwenproxy-cli 1.6.10 → 1.6.12

package/dist/delete-chats.js

@@ -1093,7 +1093,7 @@ var init_config = __esm({
       // Version header on Qwen API requests = the deployed web bundle version
       // (fallback when dynamic DOM detection is not yet completed).
       // Override via env when Qwen ships a new bundle.
-      QWEN_WEB_VERSION: z.string().default("0.3.26"),
+      QWEN_WEB_VERSION: z.string().default("0.3.43"),
       // Controls bx-ua/bx-umidtoken injection on the GENERAL API paths
       // (chats/new, settings): those work without them (live-probed). The
       // completions path is the exception — the 0.2.86 HAR shows the real
@@ -1136,6 +1136,7 @@ var init_config = __esm({
       CAPTCHA_SOLVER_ENABLED: z.string().default("true"),
       CAPTCHA_SOLVER_MAX_ATTEMPTS: z.string().default("3"),
       CAPTCHA_SOLVER_TIMEOUT_MS: z.string().default("15000"),
+      CAPTCHA_SLIDER_TIMEOUT_MS: z.string().default("8000"),
       CAPTCHA_SOLVER_RETRY_DELAY_MS: z.string().default("1000"),
       CAPTCHA_SOLVER_SETTLE_MS: z.string().default("2000"),
       CAPTCHA_ACCOUNT_COOLDOWN_MS: z.string().default("120000"),
@@ -1287,6 +1288,8 @@ var init_config = __esm({
         enabled: env.CAPTCHA_SOLVER_ENABLED === "true",
         maxAttempts: Math.max(1, Math.min(5, parseInt(env.CAPTCHA_SOLVER_MAX_ATTEMPTS))),
         timeoutMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_TIMEOUT_MS)),
+        /** Max wait for a challenge slider to become visible (slow WAF renders). */
+        sliderTimeoutMs: Math.max(500, parseInt(env.CAPTCHA_SLIDER_TIMEOUT_MS)),
         retryDelayMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_RETRY_DELAY_MS)),
         settleMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_SETTLE_MS)),
         /** Rest an account whose challenge could not be cleared before reusing it. */
@@ -1446,6 +1449,367 @@ var init_config = __esm({
   }
 });
 
+// src/services/qwen-url.ts
+function qwenUrl(path6 = "") {
+  const normalizedPath = path6.replace(/^\/+/, "");
+  return normalizedPath ? `${QWEN_BASE_URL}/${normalizedPath}` : QWEN_BASE_URL;
+}
+function qwenOrigin() {
+  return QWEN_ORIGIN;
+}
+var QWEN_BASE_URL, QWEN_ORIGIN;
+var init_qwen_url = __esm({
+  "src/services/qwen-url.ts"() {
+    "use strict";
+    init_config();
+    QWEN_BASE_URL = config.qwen.baseUrl.trim().replace(/\/+$/, "");
+    QWEN_ORIGIN = new URL(QWEN_BASE_URL).origin;
+  }
+});
+
+// src/services/fingerprint.ts
+function mulberry32(seed) {
+  return () => {
+    seed |= 0;
+    seed = seed + 1831565813 | 0;
+    let t = Math.imul(seed ^ seed >>> 15, 1 | seed);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+function seedFromString(value) {
+  let hash = 0;
+  for (let i = 0; i < value.length; i++) {
+    hash = (hash << 5) - hash + value.charCodeAt(i) | 0;
+  }
+  return hash >>> 0;
+}
+function pick(rng, values) {
+  return values[Math.floor(rng() * values.length)];
+}
+function randInt(rng, min, max) {
+  return Math.floor(rng() * (max - min + 1)) + min;
+}
+function updateChromeMajor(major) {
+  if (typeof major === "number" && major >= 100) {
+    dynamicChromeMajor = major;
+  }
+}
+function getChromeMajor() {
+  return dynamicChromeMajor;
+}
+function getSystemLocale() {
+  return process.env.QWEN_LOCALE || (typeof Intl !== "undefined" && Intl.DateTimeFormat ? Intl.DateTimeFormat().resolvedOptions().locale : "") || "pt-BR";
+}
+function getLanguageProfiles(locale = getSystemLocale()) {
+  const primary = locale.split("-")[0];
+  if (primary === "en") {
+    return [
+      ["en-US", "en"],
+      ["en-US", "en", "es"],
+      ["en", "en-US"],
+      ["en-US", "en;q=0.9"]
+    ];
+  }
+  return [
+    [locale, primary, "en-US", "en"],
+    [locale, primary, "en-US", "en", "es"],
+    [locale, "en-US", "en", primary],
+    [locale, primary, "en"],
+    [locale, `${primary};q=0.9`, "en-US;q=0.8", "en;q=0.7"]
+  ];
+}
+function rotateFingerprintSeed(accountId) {
+  const next = (rotationSalts.get(accountId) ?? 0) + 1;
+  rotationSalts.set(accountId, next);
+  profileCache.delete(accountId);
+  return next;
+}
+function getFingerprintProfile(accountId) {
+  const cached = profileCache.get(accountId);
+  if (cached) return cached;
+  const salt = rotationSalts.get(accountId) ?? 0;
+  const seed = seedFromString(salt === 0 ? accountId : `${accountId}#r${salt}`);
+  const rng = mulberry32(seed);
+  const viewport = pick(rng, VIEWPORTS);
+  const webgl = pick(rng, WEBGL_PROFILES);
+  const languages = [...pick(rng, getLanguageProfiles())];
+  const hardwareConcurrency = pick(rng, HARDWARE_CONCURRENCIES);
+  const deviceMemory = pick(rng, DEVICE_MEMORIES);
+  const platformInfo = pick(rng, PLATFORM_VERSIONS);
+  const notABrand = pick(rng, NOT_A_BRAND_VARIANTS);
+  const major = dynamicChromeMajor;
+  const build = randInt(rng, 7300, 7600);
+  const patch = randInt(rng, 0, 160);
+  const chromeVersion = `${major}.0.${build}.${patch}`;
+  const brands = [
+    { brand: notABrand.brand, version: notABrand.version },
+    { brand: "Google Chrome", version: String(major) },
+    { brand: "Chromium", version: String(major) }
+  ];
+  const fullVersionList = [
+    { brand: notABrand.brand, version: chromeVersion },
+    { brand: "Google Chrome", version: chromeVersion },
+    { brand: "Chromium", version: chromeVersion }
+  ];
+  const secChUa = brands.map((brand) => `"${brand.brand}";v="${brand.version}"`).join(", ");
+  const userAgent = `Mozilla/5.0 (Windows NT ${platformInfo.major}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeVersion} Safari/537.36`;
+  const profile = {
+    accountId,
+    seed,
+    userAgent,
+    appVersion: userAgent.replace("Mozilla/", ""),
+    chromeMajor: CHROME_MAJOR,
+    chromeVersion,
+    brands,
+    fullVersionList,
+    secChUa,
+    platform: "Win32",
+    platformVersion: platformInfo.platformVersion,
+    architecture: "x86",
+    bitness: "64",
+    languages,
+    locale: languages[0].split(";")[0],
+    timezoneId: "America/Sao_Paulo",
+    viewport,
+    hardwareConcurrency,
+    deviceMemory,
+    webglVendor: webgl.vendor,
+    webglRenderer: webgl.renderer,
+    colorDepth: 24,
+    pixelDepth: 24,
+    canvasNoiseSeed: randInt(rng, 1, 2147483647),
+    audioNoiseSeed: randInt(rng, 1, 2147483647),
+    webglNoiseSeed: randInt(rng, 1, 2147483647),
+    outerWidthOffset: randInt(rng, 0, 20),
+    outerHeightOffset: randInt(rng, 75, 95)
+  };
+  profileCache.set(accountId, profile);
+  return profile;
+}
+function clearFingerprintCache(accountId) {
+  if (accountId) profileCache.delete(accountId);
+  else profileCache.clear();
+}
+var dynamicChromeMajor, CHROME_MAJOR, VIEWPORTS, WEBGL_PROFILES, HARDWARE_CONCURRENCIES, DEVICE_MEMORIES, PLATFORM_VERSIONS, NOT_A_BRAND_VARIANTS, profileCache, rotationSalts;
+var init_fingerprint = __esm({
+  "src/services/fingerprint.ts"() {
+    "use strict";
+    dynamicChromeMajor = 151;
+    CHROME_MAJOR = 151;
+    VIEWPORTS = [
+      { width: 1366, height: 768 },
+      { width: 1440, height: 900 },
+      { width: 1536, height: 864 },
+      { width: 1600, height: 900 },
+      { width: 1680, height: 1050 },
+      { width: 1920, height: 1080 },
+      { width: 1920, height: 1200 },
+      { width: 1280, height: 720 },
+      { width: 1280, height: 800 },
+      { width: 1536, height: 864 }
+    ];
+    WEBGL_PROFILES = [
+      {
+        vendor: "Google Inc. (Intel)",
+        renderer: "ANGLE (Intel, Intel(R) UHD Graphics 630 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (Intel)",
+        renderer: "ANGLE (Intel, Intel(R) Iris(R) Xe Graphics Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (Intel)",
+        renderer: "ANGLE (Intel, Intel(R) UHD Graphics 770 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (NVIDIA)",
+        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (NVIDIA)",
+        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3070 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (NVIDIA)",
+        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (NVIDIA)",
+        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 4060 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (NVIDIA)",
+        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 4070 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (NVIDIA)",
+        renderer: "ANGLE (NVIDIA, NVIDIA GeForce GTX 1660 SUPER Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (AMD)",
+        renderer: "ANGLE (AMD, AMD Radeon RX 6600 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (AMD)",
+        renderer: "ANGLE (AMD, AMD Radeon RX 7600 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      },
+      {
+        vendor: "Google Inc. (AMD)",
+        renderer: "ANGLE (AMD, AMD Radeon RX 580 Direct3D11 vs_5_0 ps_5_0, D3D11)"
+      }
+    ];
+    HARDWARE_CONCURRENCIES = [4, 6, 8, 8, 8, 12, 16, 16, 24, 32];
+    DEVICE_MEMORIES = [4, 8, 8, 8, 16, 16, 32];
+    PLATFORM_VERSIONS = [
+      { platform: "Windows", platformVersion: "14.0.0", major: "10" },
+      { platform: "Windows", platformVersion: "15.0.0", major: "11" },
+      { platform: "Windows", platformVersion: "14.0.0", major: "10" },
+      { platform: "Windows", platformVersion: "15.0.0", major: "11" }
+    ];
+    NOT_A_BRAND_VARIANTS = [
+      { brand: "Not/A)Brand", version: "99" },
+      { brand: "Not)A_Brand", version: "99" },
+      { brand: "Not/A)Brand", version: "8" },
+      { brand: "Not?A_Brand", version: "24" },
+      { brand: "Not/A)Brand", version: "99" }
+    ];
+    profileCache = /* @__PURE__ */ new Map();
+    rotationSalts = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/utils/timezone.ts
+function formatAsciiTimezone(date = /* @__PURE__ */ new Date()) {
+  const dayName = DAYS[date.getDay()];
+  const monthName = MONTHS[date.getMonth()];
+  const day = String(date.getDate()).padStart(2, "0");
+  const year = date.getFullYear();
+  const hours = String(date.getHours()).padStart(2, "0");
+  const minutes = String(date.getMinutes()).padStart(2, "0");
+  const seconds = String(date.getSeconds()).padStart(2, "0");
+  const offsetMinutes = -date.getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? "+" : "-";
+  const absOffset = Math.abs(offsetMinutes);
+  const offsetHours = String(Math.floor(absOffset / 60)).padStart(2, "0");
+  const offsetMins = String(absOffset % 60).padStart(2, "0");
+  const tzOffset = `GMT${sign}${offsetHours}${offsetMins}`;
+  return `${dayName} ${monthName} ${day} ${year} ${hours}:${minutes}:${seconds} ${tzOffset}`;
+}
+function sanitizeHeaderForFetch(val) {
+  if (typeof val !== "string") return "";
+  return val.replace(/[^\x00-\xFF]/g, "");
+}
+var DAYS, MONTHS;
+var init_timezone = __esm({
+  "src/utils/timezone.ts"() {
+    "use strict";
+    DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+    MONTHS = [
+      "Jan",
+      "Feb",
+      "Mar",
+      "Apr",
+      "May",
+      "Jun",
+      "Jul",
+      "Aug",
+      "Sep",
+      "Oct",
+      "Nov",
+      "Dec"
+    ];
+  }
+});
+
+// src/services/qwen-headers.ts
+import { v4 as uuidv4 } from "uuid";
+function getSystemAcceptLanguage(customLocale) {
+  const locale = customLocale || getSystemLocale();
+  const primary = locale.split("-")[0];
+  if (locale.toLowerCase() === "en-us" || locale.toLowerCase() === "en") {
+    return "en-US,en;q=0.9";
+  }
+  if (locale.toLowerCase().startsWith("pt")) {
+    return "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7";
+  }
+  return `${locale},${primary};q=0.9,en-US;q=0.8,en;q=0.7`;
+}
+function getDefaultQwenUserAgent(major = getChromeMajor()) {
+  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
+}
+function updateQwenWebVersion(version) {
+  if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
+    dynamicWebVersion = version.trim();
+  }
+}
+function getQwenWebVersion() {
+  return dynamicWebVersion || config.qwen.webVersion;
+}
+function updateQwenBxVersion(version) {
+  if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
+    dynamicBxVersion = version.trim();
+  }
+}
+function getQwenBxVersion() {
+  return dynamicBxVersion || config.auth.bxV;
+}
+function buildQwenRequestHeaders(opts) {
+  const headers = {
+    ...opts.extra ?? {},
+    Accept: "application/json",
+    "Accept-Language": opts.extra?.["Accept-Language"] || opts.acceptLanguage || getSystemAcceptLanguage(),
+    "Accept-Encoding": "gzip, deflate, br, zstd",
+    "Content-Type": "application/json",
+    Cookie: opts.cookie,
+    Origin: qwenOrigin(),
+    Referer: opts.extra?.Referer ?? (opts.chatSessionId ? qwenUrl(`/c/${encodeURIComponent(opts.chatSessionId)}`) : qwenUrl("/")),
+    "Sec-Fetch-Dest": "empty",
+    "Sec-Fetch-Mode": "cors",
+    "Sec-Fetch-Site": "same-origin",
+    Connection: "keep-alive",
+    "User-Agent": opts.userAgent || getDefaultQwenUserAgent(),
+    "X-Request-Id": uuidv4(),
+    "bx-v": opts.bxV || getQwenBxVersion(),
+    source: "web",
+    version: opts.version || getQwenWebVersion(),
+    timezone: opts.extra?.timezone || opts.extra?.Timezone || formatAsciiTimezone(),
+    Timezone: opts.extra?.Timezone || opts.extra?.timezone || formatAsciiTimezone(),
+    // Use the real browser client-hints when captured (anti-hardcoded); fall
+    // back to the static fingerprint otherwise.
+    "sec-ch-ua": opts.secChUa || `"Google Chrome";v="${getChromeMajor()}", "Chromium";v="${getChromeMajor()}", "Not.A/Brand";v="99"`,
+    "sec-ch-ua-mobile": opts.secChUaMobile || "?0",
+    "sec-ch-ua-platform": opts.secChUaPlatform || '"Windows"'
+  };
+  const tokenMatch = opts.cookie?.match(/(?:^|;\s*)token=([^;]+)/);
+  if (tokenMatch && !headers["Authorization"] && !headers["authorization"]) {
+    const bearer = decodeURIComponent(tokenMatch[1].trim());
+    if (bearer && bearer !== '""' && bearer !== "null") {
+      headers["Authorization"] = `Bearer ${bearer}`;
+    }
+  }
+  if (config.qwen.sendBxUa) {
+    if (opts.bxUa) headers["bx-ua"] = opts.bxUa;
+    if (opts.bxUmidtoken) headers["bx-umidtoken"] = opts.bxUmidtoken;
+  }
+  return headers;
+}
+var dynamicWebVersion, dynamicBxVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
+var init_qwen_headers = __esm({
+  "src/services/qwen-headers.ts"() {
+    "use strict";
+    init_qwen_url();
+    init_config();
+    init_fingerprint();
+    init_timezone();
+    dynamicWebVersion = null;
+    dynamicBxVersion = null;
+    QWEN_WEB_VERSION = config.qwen.webVersion;
+    DEFAULT_QWEN_USER_AGENT = getDefaultQwenUserAgent(151);
+    QWEN_TIMEZONE_HEADER = (/* @__PURE__ */ new Date()).toString().split(" (")[0];
+  }
+});
+
 // src/core/logger.ts
 import "dotenv/config";
 function maskEmail(email) {
@@ -2185,232 +2549,46 @@ function clearAccountCooldown(accountId) {
     }
   }
 }
-function markAccountHeadersReady(accountId) {
-  if (!accountId || accountId === "global") return;
-  headersReadyAccounts.add(accountId);
-}
-function unmarkAccountHeadersReady(accountId) {
-  if (!accountId) return;
-  headersReadyAccounts.delete(accountId);
-}
-function isAccountHeadersReady(accountId) {
-  return headersReadyAccounts.has(accountId);
-}
-var cooldowns, headersReadyAccounts;
-var init_account_manager = __esm({
-  "src/core/account-manager.ts"() {
-    "use strict";
-    init_accounts();
-    init_account_priority();
-    init_logger();
-    cooldowns = /* @__PURE__ */ new Map();
-    headersReadyAccounts = /* @__PURE__ */ new Set();
-  }
-});
-
-// src/services/fingerprint.ts
-function mulberry32(seed) {
-  return () => {
-    seed |= 0;
-    seed = seed + 1831565813 | 0;
-    let t = Math.imul(seed ^ seed >>> 15, 1 | seed);
-    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
-    return ((t ^ t >>> 14) >>> 0) / 4294967296;
-  };
-}
-function seedFromString(value) {
-  let hash = 0;
-  for (let i = 0; i < value.length; i++) {
-    hash = (hash << 5) - hash + value.charCodeAt(i) | 0;
-  }
-  return hash >>> 0;
-}
-function pick(rng, values) {
-  return values[Math.floor(rng() * values.length)];
-}
-function randInt(rng, min, max) {
-  return Math.floor(rng() * (max - min + 1)) + min;
-}
-function updateChromeMajor(major) {
-  if (typeof major === "number" && major >= 100) {
-    dynamicChromeMajor = major;
-  }
-}
-function getChromeMajor() {
-  return dynamicChromeMajor;
-}
-function getSystemLocale() {
-  return process.env.QWEN_LOCALE || (typeof Intl !== "undefined" && Intl.DateTimeFormat ? Intl.DateTimeFormat().resolvedOptions().locale : "") || "pt-BR";
-}
-function getLanguageProfiles(locale = getSystemLocale()) {
-  const primary = locale.split("-")[0];
-  if (primary === "en") {
-    return [
-      ["en-US", "en"],
-      ["en-US", "en", "es"],
-      ["en", "en-US"],
-      ["en-US", "en;q=0.9"]
-    ];
+function getAccountCooldownInfo(accountId) {
+  const entry = cooldowns.get(accountId);
+  if (!entry) return null;
+  const remaining = entry.until - Date.now();
+  if (remaining <= 0) {
+    cooldowns.delete(accountId);
+    if (accountId !== "global") {
+      try {
+        updateAccountCooldown(accountId, 0, null);
+      } catch (err) {
+        console.error(
+          `\u274C [AccountManager] Failed to clear expired cooldown in DB:`,
+          err.message
+        );
+      }
+    }
+    return null;
   }
-  return [
-    [locale, primary, "en-US", "en"],
-    [locale, primary, "en-US", "en", "es"],
-    [locale, "en-US", "en", primary],
-    [locale, primary, "en"],
-    [locale, `${primary};q=0.9`, "en-US;q=0.8", "en;q=0.7"]
-  ];
+  return { onCooldown: true, remainingMs: remaining, reason: entry.reason };
 }
-function getFingerprintProfile(accountId) {
-  const cached = profileCache.get(accountId);
-  if (cached) return cached;
-  const salt = rotationSalts.get(accountId) ?? 0;
-  const seed = seedFromString(salt === 0 ? accountId : `${accountId}#r${salt}`);
-  const rng = mulberry32(seed);
-  const viewport = pick(rng, VIEWPORTS);
-  const webgl = pick(rng, WEBGL_PROFILES);
-  const languages = [...pick(rng, getLanguageProfiles())];
-  const hardwareConcurrency = pick(rng, HARDWARE_CONCURRENCIES);
-  const deviceMemory = pick(rng, DEVICE_MEMORIES);
-  const platformInfo = pick(rng, PLATFORM_VERSIONS);
-  const notABrand = pick(rng, NOT_A_BRAND_VARIANTS);
-  const major = dynamicChromeMajor;
-  const build = randInt(rng, 7300, 7600);
-  const patch = randInt(rng, 0, 160);
-  const chromeVersion = `${major}.0.${build}.${patch}`;
-  const brands = [
-    { brand: notABrand.brand, version: notABrand.version },
-    { brand: "Google Chrome", version: String(major) },
-    { brand: "Chromium", version: String(major) }
-  ];
-  const fullVersionList = [
-    { brand: notABrand.brand, version: chromeVersion },
-    { brand: "Google Chrome", version: chromeVersion },
-    { brand: "Chromium", version: chromeVersion }
-  ];
-  const secChUa = brands.map((brand) => `"${brand.brand}";v="${brand.version}"`).join(", ");
-  const userAgent = `Mozilla/5.0 (Windows NT ${platformInfo.major}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeVersion} Safari/537.36`;
-  const profile = {
-    accountId,
-    seed,
-    userAgent,
-    appVersion: userAgent.replace("Mozilla/", ""),
-    chromeMajor: CHROME_MAJOR,
-    chromeVersion,
-    brands,
-    fullVersionList,
-    secChUa,
-    platform: "Win32",
-    platformVersion: platformInfo.platformVersion,
-    architecture: "x86",
-    bitness: "64",
-    languages,
-    locale: languages[0].split(";")[0],
-    timezoneId: "America/Sao_Paulo",
-    viewport,
-    hardwareConcurrency,
-    deviceMemory,
-    webglVendor: webgl.vendor,
-    webglRenderer: webgl.renderer,
-    colorDepth: 24,
-    pixelDepth: 24,
-    canvasNoiseSeed: randInt(rng, 1, 2147483647),
-    audioNoiseSeed: randInt(rng, 1, 2147483647),
-    webglNoiseSeed: randInt(rng, 1, 2147483647),
-    outerWidthOffset: randInt(rng, 0, 20),
-    outerHeightOffset: randInt(rng, 75, 95)
-  };
-  profileCache.set(accountId, profile);
-  return profile;
+function markAccountHeadersReady(accountId) {
+  if (!accountId || accountId === "global") return;
+  headersReadyAccounts.add(accountId);
 }
-function clearFingerprintCache(accountId) {
-  if (accountId) profileCache.delete(accountId);
-  else profileCache.clear();
+function unmarkAccountHeadersReady(accountId) {
+  if (!accountId) return;
+  headersReadyAccounts.delete(accountId);
 }
-var dynamicChromeMajor, CHROME_MAJOR, VIEWPORTS, WEBGL_PROFILES, HARDWARE_CONCURRENCIES, DEVICE_MEMORIES, PLATFORM_VERSIONS, NOT_A_BRAND_VARIANTS, profileCache, rotationSalts;
-var init_fingerprint = __esm({
-  "src/services/fingerprint.ts"() {
+function isAccountHeadersReady(accountId) {
+  return headersReadyAccounts.has(accountId);
+}
+var cooldowns, headersReadyAccounts;
+var init_account_manager = __esm({
+  "src/core/account-manager.ts"() {
     "use strict";
-    dynamicChromeMajor = 151;
-    CHROME_MAJOR = 151;
-    VIEWPORTS = [
-      { width: 1366, height: 768 },
-      { width: 1440, height: 900 },
-      { width: 1536, height: 864 },
-      { width: 1600, height: 900 },
-      { width: 1680, height: 1050 },
-      { width: 1920, height: 1080 },
-      { width: 1920, height: 1200 },
-      { width: 1280, height: 720 },
-      { width: 1280, height: 800 },
-      { width: 1536, height: 864 }
-    ];
-    WEBGL_PROFILES = [
-      {
-        vendor: "Google Inc. (Intel)",
-        renderer: "ANGLE (Intel, Intel(R) UHD Graphics 630 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (Intel)",
-        renderer: "ANGLE (Intel, Intel(R) Iris(R) Xe Graphics Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (Intel)",
-        renderer: "ANGLE (Intel, Intel(R) UHD Graphics 770 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (NVIDIA)",
-        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (NVIDIA)",
-        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3070 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (NVIDIA)",
-        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (NVIDIA)",
-        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 4060 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (NVIDIA)",
-        renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 4070 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (NVIDIA)",
-        renderer: "ANGLE (NVIDIA, NVIDIA GeForce GTX 1660 SUPER Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (AMD)",
-        renderer: "ANGLE (AMD, AMD Radeon RX 6600 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (AMD)",
-        renderer: "ANGLE (AMD, AMD Radeon RX 7600 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      },
-      {
-        vendor: "Google Inc. (AMD)",
-        renderer: "ANGLE (AMD, AMD Radeon RX 580 Direct3D11 vs_5_0 ps_5_0, D3D11)"
-      }
-    ];
-    HARDWARE_CONCURRENCIES = [4, 6, 8, 8, 8, 12, 16, 16, 24, 32];
-    DEVICE_MEMORIES = [4, 8, 8, 8, 16, 16, 32];
-    PLATFORM_VERSIONS = [
-      { platform: "Windows", platformVersion: "14.0.0", major: "10" },
-      { platform: "Windows", platformVersion: "15.0.0", major: "11" },
-      { platform: "Windows", platformVersion: "14.0.0", major: "10" },
-      { platform: "Windows", platformVersion: "15.0.0", major: "11" }
-    ];
-    NOT_A_BRAND_VARIANTS = [
-      { brand: "Not/A)Brand", version: "99" },
-      { brand: "Not)A_Brand", version: "99" },
-      { brand: "Not/A)Brand", version: "8" },
-      { brand: "Not?A_Brand", version: "24" },
-      { brand: "Not/A)Brand", version: "99" }
-    ];
-    profileCache = /* @__PURE__ */ new Map();
-    rotationSalts = /* @__PURE__ */ new Map();
+    init_accounts();
+    init_account_priority();
+    init_logger();
+    cooldowns = /* @__PURE__ */ new Map();
+    headersReadyAccounts = /* @__PURE__ */ new Set();
   }
 });
 
@@ -2552,10 +2730,298 @@ function extractBaxiaChallengeUrl(body, baseUrl) {
     } catch {
       continue;
     }
-    if (url.protocol !== base.protocol || url.host !== base.host) continue;
-    return url.toString();
+    if (url.protocol !== base.protocol || url.host !== base.host) continue;
+    return url.toString();
+  }
+  return null;
+}
+async function findVisibleLocatorWithin(page, selectors, timeoutMs) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  while (true) {
+    const found = await findVisibleLocator(page, selectors);
+    if (found) return found;
+    if (Date.now() >= deadline) return null;
+    await sleep(Math.min(150, Math.max(1, deadline - Date.now())));
+  }
+}
+async function waitForHidden(locator, timeoutMs) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  while (true) {
+    if (!await isVisible(locator)) return true;
+    if (Date.now() >= deadline) return false;
+    await sleep(Math.min(100, Math.max(1, deadline - Date.now())));
+  }
+}
+async function computeAliyunPuzzleOffset(page) {
+  return page.evaluate(() => {
+    const background = document.querySelector(
+      "#aliyunCaptcha-img"
+    );
+    const piece = document.querySelector(
+      "#aliyunCaptcha-puzzle"
+    );
+    if (!background || !piece) {
+      return Promise.resolve({ ok: false, reason: "missing puzzle images" });
+    }
+    const compute = () => {
+      try {
+        const width = background.naturalWidth;
+        const height = background.naturalHeight;
+        const pieceWidth = piece.naturalWidth;
+        const pieceHeight = piece.naturalHeight;
+        if (!width || !height || !pieceWidth || !pieceHeight) {
+          return { ok: false, reason: "image dimensions unavailable" };
+        }
+        const backgroundCanvas = document.createElement("canvas");
+        backgroundCanvas.id = "captcha-solver-canvas";
+        backgroundCanvas.width = width;
+        backgroundCanvas.height = height;
+        const backgroundContext = backgroundCanvas.getContext("2d");
+        if (!backgroundContext) {
+          return { ok: false, reason: "no background context" };
+        }
+        const pieceCanvas = document.createElement("canvas");
+        pieceCanvas.id = "captcha-solver-canvas";
+        pieceCanvas.width = pieceWidth;
+        pieceCanvas.height = pieceHeight;
+        const pieceContext = pieceCanvas.getContext("2d");
+        if (!pieceContext) {
+          return { ok: false, reason: "no piece context" };
+        }
+        try {
+          backgroundContext.drawImage(background, 0, 0);
+        } catch {
+          return { ok: false, reason: "background canvas tainted" };
+        }
+        try {
+          pieceContext.drawImage(piece, 0, 0);
+        } catch {
+          return { ok: false, reason: "puzzle canvas tainted" };
+        }
+        const backgroundData = backgroundContext.getImageData(
+          0,
+          0,
+          width,
+          height
+        ).data;
+        const pieceData = pieceContext.getImageData(
+          0,
+          0,
+          pieceWidth,
+          pieceHeight
+        ).data;
+        let pieceMinX = pieceWidth;
+        let pieceMaxX = -1;
+        let pieceMinY = pieceHeight;
+        let pieceMaxY = -1;
+        for (let y = 0; y < pieceHeight; y++) {
+          for (let x = 0; x < pieceWidth; x++) {
+            if (pieceData[(y * pieceWidth + x) * 4 + 3] > 100) {
+              if (x < pieceMinX) pieceMinX = x;
+              if (x > pieceMaxX) pieceMaxX = x;
+              if (y < pieceMinY) pieceMinY = y;
+              if (y > pieceMaxY) pieceMaxY = y;
+            }
+          }
+        }
+        const puzzleWidth = pieceMaxX - pieceMinX + 1;
+        if (puzzleWidth <= 0) {
+          return { ok: false, reason: "empty puzzle piece" };
+        }
+        const yStart = Math.max(1, Math.min(height - 2, pieceMinY + 5));
+        const yEnd = Math.max(
+          yStart,
+          Math.min(height - 2, pieceMaxY - 5)
+        );
+        const columnGradients = new Float32Array(width);
+        for (let x = 1; x < width - 1; x++) {
+          let gradient = 0;
+          for (let y = yStart; y <= yEnd; y++) {
+            const left = (y * width + x - 1) * 4;
+            const right = (y * width + x + 1) * 4;
+            gradient += Math.abs(backgroundData[right] - backgroundData[left]) + Math.abs(backgroundData[right + 1] - backgroundData[left + 1]) + Math.abs(backgroundData[right + 2] - backgroundData[left + 2]);
+          }
+          columnGradients[x] = gradient;
+        }
+        let bestX = 0;
+        let bestScore = 0;
+        const minCandidateX = 30;
+        const maxCandidateX = width - puzzleWidth - 20;
+        for (let candidateX = minCandidateX; candidateX <= maxCandidateX; candidateX++) {
+          let leftMax = 0;
+          for (let dx = -2; dx <= 2; dx++) {
+            const value = columnGradients[candidateX + pieceMinX + dx] || 0;
+            if (value > leftMax) leftMax = value;
+          }
+          let rightMax = 0;
+          for (let dx = -3; dx <= 1; dx++) {
+            const value = columnGradients[candidateX + pieceMaxX + dx] || 0;
+            if (value > rightMax) rightMax = value;
+          }
+          const score = Math.sqrt(leftMax * rightMax);
+          if (score > bestScore) {
+            bestScore = score;
+            bestX = candidateX;
+          }
+        }
+        if (bestScore <= 0) {
+          return { ok: false, reason: "no matching hole edge" };
+        }
+        return {
+          ok: true,
+          offsetX: bestX - pieceMinX,
+          naturalWidth: width
+        };
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : String(error)
+        };
+      }
+    };
+    return new Promise((resolve) => {
+      if (background.complete && piece.complete) {
+        resolve(compute());
+        return;
+      }
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        resolve(compute());
+      };
+      const fail = () => {
+        if (settled) return;
+        settled = true;
+        resolve({ ok: false, reason: "puzzle image load error" });
+      };
+      background.addEventListener("load", finish, { once: true });
+      piece.addEventListener("load", finish, { once: true });
+      background.addEventListener("error", fail, { once: true });
+      piece.addEventListener("error", fail, { once: true });
+      setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        resolve({ ok: false, reason: "puzzle image load timeout" });
+      }, 2e3);
+    });
+  });
+}
+async function solveAliyunWafCaptcha(page, options = {}) {
+  const waitForMs = Math.max(0, options.waitForMs ?? 0);
+  const maxAttempts = Math.max(
+    1,
+    Math.min(5, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS)
+  );
+  const retryDelayMs = Math.max(
+    0,
+    options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS
+  );
+  const settleMs = Math.max(0, options.settleMs ?? DEFAULT_SETTLE_MS);
+  const sliderTimeoutMs = Math.max(
+    500,
+    options.sliderTimeoutMs ?? DEFAULT_SLIDER_TIMEOUT_MS
+  );
+  const detected = await findVisibleLocatorWithin(
+    page,
+    ALIYUN_WAF_BLOCK_SELECTORS,
+    waitForMs
+  );
+  if (!detected) return false;
+  return withCaptchaMouseLock(async () => {
+    const block = detected.locator;
+    if (!await isVisible(block)) return false;
+    logBaxiaCaptcha("aliyun_detected", { selector: detected.selector });
+    let lastReason = "unknown";
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        const offset = await computeAliyunPuzzleOffset(page);
+        if (!offset.ok || typeof offset.offsetX !== "number" || typeof offset.naturalWidth !== "number" || offset.naturalWidth <= 0) {
+          lastReason = offset.reason || "offset_unavailable";
+          logBaxiaCaptcha("aliyun_offset_failed", {
+            attempt,
+            reason: lastReason
+          });
+        } else {
+          const slider = page.locator(ALIYUN_PUZZLE_SLIDER_SELECTOR).first();
+          const track = page.locator(ALIYUN_PUZZLE_TRACK_SELECTOR).first();
+          await slider.waitFor({ state: "visible", timeout: sliderTimeoutMs });
+          const [sliderBox, trackBox] = await Promise.all([
+            slider.boundingBox(),
+            track.boundingBox()
+          ]);
+          if (!sliderBox || !trackBox || trackBox.width <= 0) {
+            lastReason = "bounds_unavailable";
+            logBaxiaCaptcha("aliyun_offset_failed", {
+              attempt,
+              reason: lastReason
+            });
+          } else {
+            const scale = trackBox.width / offset.naturalWidth;
+            const dragDistance = Math.round(offset.offsetX * scale);
+            logBaxiaCaptcha("aliyun_geometry", {
+              attempt,
+              offset: offset.offsetX,
+              scale: Number(scale.toFixed(2)),
+              distance: dragDistance
+            });
+            if (dragDistance <= 0) {
+              lastReason = "non_positive_distance";
+            } else {
+              const startX = sliderBox.x + sliderBox.width / 2;
+              const startY = sliderBox.y + sliderBox.height / 2;
+              await humanDrag(
+                page,
+                startX,
+                startY,
+                startX + dragDistance,
+                startY
+              );
+              if (await waitForHidden(block, settleMs)) {
+                logBaxiaCaptcha(
+                  "aliyun_solve_succeeded",
+                  { attempt, distance: dragDistance },
+                  true
+                );
+                return true;
+              }
+              lastReason = "not_solved";
+            }
+          }
+        }
+      } catch (error) {
+        lastReason = error instanceof Error ? error.name : "UnknownError";
+        logBaxiaCaptcha("aliyun_offset_failed", {
+          attempt,
+          error: lastReason,
+          detail: sanitizeCaptchaErrorDetail(error)
+        });
+      }
+      if (attempt < maxAttempts && retryDelayMs > 0) {
+        await sleep(retryDelayMs);
+      }
+    }
+    logBaxiaCaptcha(
+      "aliyun_solve_failed",
+      { attempts: maxAttempts, reason: lastReason },
+      true
+    );
+    return false;
+  });
+}
+async function solveVisibleCaptcha(page, options = {}) {
+  if (typeof page.isClosed === "function" && page.isClosed()) return false;
+  const totalWaitMs = Math.max(0, options.waitForMs ?? 0);
+  const aliyunWaitMs = Math.min(totalWaitMs, ALIYUN_PROBE_MAX_WAIT_MS);
+  const startedAt = Date.now();
+  if (await solveAliyunWafCaptcha(page, { ...options, waitForMs: aliyunWaitMs })) {
+    return true;
   }
-  return null;
+  const remainingWaitMs = Math.max(
+    0,
+    totalWaitMs - (Date.now() - startedAt)
+  );
+  return solveBaxiaCaptcha(page, { ...options, waitForMs: remainingWaitMs });
 }
 async function isVisible(locator) {
   return locator.isVisible().catch(() => false);
@@ -2826,7 +3292,7 @@ function startBaxiaCaptchaWatcher(page, timeoutMs, options = {}) {
     promise
   };
 }
-var BAXIA_DIALOG_SELECTOR, BAXIA_CONTENT_SELECTOR, CAPTCHA_EVENT_EMOJI, captchaDebugEnabled, BAXIA_IFRAME_SELECTORS, BAXIA_DOCUMENT_SELECTORS, BAXIA_IFRAME_SELECTOR, BAXIA_SLIDER_SELECTOR, BAXIA_TRACK_SELECTOR, BAXIA_SUCCESS_SELECTOR, BAXIA_RELOAD_SELECTOR, DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_SETTLE_MS, DEFAULT_SLIDER_TIMEOUT_MS, captchaMouseLock;
+var BAXIA_DIALOG_SELECTOR, BAXIA_CONTENT_SELECTOR, CAPTCHA_EVENT_EMOJI, captchaDebugEnabled, BAXIA_IFRAME_SELECTORS, BAXIA_DOCUMENT_SELECTORS, BAXIA_IFRAME_SELECTOR, BAXIA_SLIDER_SELECTOR, BAXIA_TRACK_SELECTOR, BAXIA_SUCCESS_SELECTOR, BAXIA_RELOAD_SELECTOR, DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_SETTLE_MS, DEFAULT_SLIDER_TIMEOUT_MS, ALIYUN_WAF_CAPTCHA_SELECTOR, ALIYUN_WAF_CAPTCHA_WIDGET, ALIYUN_WAF_BLOCK_SELECTORS, ALIYUN_PUZZLE_SLIDER_SELECTOR, ALIYUN_PUZZLE_TRACK_SELECTOR, ALIYUN_PROBE_MAX_WAIT_MS, captchaMouseLock;
 var init_captcha_solver = __esm({
   "src/services/captcha-solver.ts"() {
     "use strict";
@@ -2852,14 +3318,20 @@ var init_captcha_solver = __esm({
       solve_failed: "\u274C",
       recovery_succeeded: "\u2705",
       recovery_not_solved: "\u26A0\uFE0F",
-      recovery_failed: "\u274C"
+      recovery_failed: "\u274C",
+      aliyun_detected: "\u{1F9E9}",
+      aliyun_offset_failed: "\u{1F4D0}",
+      aliyun_geometry: "\u{1F4D0}",
+      aliyun_solve_succeeded: "\u2705",
+      aliyun_solve_failed: "\u274C"
     };
     captchaDebugEnabled = process.env.CAPTCHA_DEBUG === "true";
     BAXIA_IFRAME_SELECTORS = [
       `${BAXIA_DIALOG_SELECTOR} ${BAXIA_CONTENT_SELECTOR} iframe`,
       `${BAXIA_CONTENT_SELECTOR} iframe`,
       "iframe#baxia-dialog-content",
-      'iframe[src*="_____tmd_____/punish"]'
+      'iframe[src*="_____tmd_____/punish"]',
+      'iframe[src*="nocaptcha"]'
     ];
     BAXIA_DOCUMENT_SELECTORS = [
       "#nocaptcha",
@@ -2867,41 +3339,71 @@ var init_captcha_solver = __esm({
       "#baxia-punish"
     ];
     BAXIA_IFRAME_SELECTOR = BAXIA_IFRAME_SELECTORS.join(", ");
-    BAXIA_SLIDER_SELECTOR = "#nc_1_n1z, .nc_1_n1z, .btn_slide, .nc_wrapper .btn_slide, ._nc .btn_slide, .nc-container .btn_slide";
-    BAXIA_TRACK_SELECTOR = "#nc_1_n1t, .nc_scale, .nc_wrapper .nc_scale, ._nc .nc_scale, .nc-container .nc_scale";
+    BAXIA_SLIDER_SELECTOR = '#nc_1_n1z, .nc_1_n1z, .btn_slide, .nc_iconfont.btn_slide, span[id*="_n1z"], .nc_wrapper .btn_slide, ._nc .btn_slide, .nc-container .btn_slide';
+    BAXIA_TRACK_SELECTOR = '#nc_1_n1t, .nc_scale, span[id*="_n1t"], .nc_wrapper .nc_scale, ._nc .nc_scale, .nc-container .nc_scale';
     BAXIA_SUCCESS_SELECTOR = '.btn_ok, .nc_ok, .nc_success, .nc_result, .nc_wrapper.nc-success, .nc_wrapper.success, [data-nc-lang="SUCCESS"], [data-nc-lang="success"], #nc-loading-circle';
     BAXIA_RELOAD_SELECTOR = '#nc_1_refresh1, .errloading a, .nc-container .errloading a, .btn_refresh, .clickCaptcha_text .btn_refresh, [data-nc-lang="REFRESH"], a[id*="refresh"]';
     DEFAULT_MAX_ATTEMPTS = 3;
     DEFAULT_RETRY_DELAY_MS = 1e3;
     DEFAULT_SETTLE_MS = 2e3;
     DEFAULT_SLIDER_TIMEOUT_MS = 8e3;
+    ALIYUN_WAF_CAPTCHA_SELECTOR = "#waf_nc_block";
+    ALIYUN_WAF_CAPTCHA_WIDGET = "#aliyunCaptcha-window-embed";
+    ALIYUN_WAF_BLOCK_SELECTORS = [
+      ALIYUN_WAF_CAPTCHA_SELECTOR,
+      ALIYUN_WAF_CAPTCHA_WIDGET
+    ];
+    ALIYUN_PUZZLE_SLIDER_SELECTOR = "#aliyunCaptcha-sliding-slider";
+    ALIYUN_PUZZLE_TRACK_SELECTOR = "#aliyunCaptcha-sliding-body";
+    ALIYUN_PROBE_MAX_WAIT_MS = 2e3;
     captchaMouseLock = Promise.resolve();
   }
 });
 
-// src/services/qwen-url.ts
-function qwenUrl(path6 = "") {
-  const normalizedPath = path6.replace(/^\/+/, "");
-  return normalizedPath ? `${QWEN_BASE_URL}/${normalizedPath}` : QWEN_BASE_URL;
-}
-function qwenOrigin() {
-  return QWEN_ORIGIN;
-}
-var QWEN_BASE_URL, QWEN_ORIGIN;
-var init_qwen_url = __esm({
-  "src/services/qwen-url.ts"() {
-    "use strict";
-    init_config();
-    QWEN_BASE_URL = config.qwen.baseUrl.trim().replace(/\/+$/, "");
-    QWEN_ORIGIN = new URL(QWEN_BASE_URL).origin;
-  }
-});
-
 // src/core/waf-isolation.ts
 function setWafContextResetListener(fn) {
   contextResetListener = fn;
 }
-var contextResetListener;
+function getState(accountId) {
+  let state = states.get(accountId);
+  if (!state) {
+    state = { consecutiveHardBlocks: 0, lastBlockAt: 0 };
+    states.set(accountId, state);
+  }
+  return state;
+}
+function recordWafHardBlock(accountId) {
+  const state = getState(accountId);
+  state.consecutiveHardBlocks += 1;
+  state.lastBlockAt = Date.now();
+  const base = config.captcha.accountCooldownMs;
+  const cap = config.captcha.hardBlockMaxCooldownMs;
+  const exponent = Math.min(
+    state.consecutiveHardBlocks - 1,
+    MAX_CONSECUTIVE_FOR_ESCALATION
+  );
+  const cooldownMs = Math.min(cap, base * Math.pow(ESCALATION_FACTOR, exponent));
+  if (cooldownMs > 0) {
+    markAccountRateLimited(accountId, cooldownMs, "WafChallenge");
+  }
+  rotateFingerprintSeed(accountId);
+  logger.warn(
+    `[WafIsolation] Hard WAF block on ${accountId}: fingerprint rotated (streak ${state.consecutiveHardBlocks}), quarantined ${Math.round(cooldownMs / 1e3)}s`
+  );
+  if (contextResetListener) {
+    void Promise.resolve(contextResetListener(accountId)).catch((error) => {
+      logger.warn(
+        `[WafIsolation] Context reset listener failed for ${accountId}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    });
+  }
+  return {
+    cooldownMs,
+    fingerprintRotated: true,
+    escalated: state.consecutiveHardBlocks > 1
+  };
+}
+var ESCALATION_FACTOR, MAX_CONSECUTIVE_FOR_ESCALATION, states, contextResetListener;
 var init_waf_isolation = __esm({
   "src/core/waf-isolation.ts"() {
     "use strict";
@@ -2909,132 +3411,13 @@ var init_waf_isolation = __esm({
     init_logger();
     init_account_manager();
     init_fingerprint();
+    ESCALATION_FACTOR = 2;
+    MAX_CONSECUTIVE_FOR_ESCALATION = 4;
+    states = /* @__PURE__ */ new Map();
     contextResetListener = null;
   }
 });
 
-// src/utils/timezone.ts
-function formatAsciiTimezone(date = /* @__PURE__ */ new Date()) {
-  const dayName = DAYS[date.getDay()];
-  const monthName = MONTHS[date.getMonth()];
-  const day = String(date.getDate()).padStart(2, "0");
-  const year = date.getFullYear();
-  const hours = String(date.getHours()).padStart(2, "0");
-  const minutes = String(date.getMinutes()).padStart(2, "0");
-  const seconds = String(date.getSeconds()).padStart(2, "0");
-  const offsetMinutes = -date.getTimezoneOffset();
-  const sign = offsetMinutes >= 0 ? "+" : "-";
-  const absOffset = Math.abs(offsetMinutes);
-  const offsetHours = String(Math.floor(absOffset / 60)).padStart(2, "0");
-  const offsetMins = String(absOffset % 60).padStart(2, "0");
-  const tzOffset = `GMT${sign}${offsetHours}${offsetMins}`;
-  return `${dayName} ${monthName} ${day} ${year} ${hours}:${minutes}:${seconds} ${tzOffset}`;
-}
-function sanitizeHeaderForFetch(val) {
-  if (typeof val !== "string") return "";
-  return val.replace(/[^\x00-\xFF]/g, "");
-}
-var DAYS, MONTHS;
-var init_timezone = __esm({
-  "src/utils/timezone.ts"() {
-    "use strict";
-    DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-    MONTHS = [
-      "Jan",
-      "Feb",
-      "Mar",
-      "Apr",
-      "May",
-      "Jun",
-      "Jul",
-      "Aug",
-      "Sep",
-      "Oct",
-      "Nov",
-      "Dec"
-    ];
-  }
-});
-
-// src/services/qwen-headers.ts
-import { v4 as uuidv4 } from "uuid";
-function getSystemAcceptLanguage(customLocale) {
-  const locale = customLocale || getSystemLocale();
-  const primary = locale.split("-")[0];
-  if (locale.toLowerCase() === "en-us" || locale.toLowerCase() === "en") {
-    return "en-US,en;q=0.9";
-  }
-  if (locale.toLowerCase().startsWith("pt")) {
-    return "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7";
-  }
-  return `${locale},${primary};q=0.9,en-US;q=0.8,en;q=0.7`;
-}
-function getDefaultQwenUserAgent(major = getChromeMajor()) {
-  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
-}
-function updateQwenWebVersion(version) {
-  if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
-    dynamicWebVersion = version.trim();
-  }
-}
-function getQwenWebVersion() {
-  return dynamicWebVersion || config.qwen.webVersion;
-}
-function buildQwenRequestHeaders(opts) {
-  const headers = {
-    ...opts.extra ?? {},
-    Accept: "application/json",
-    "Accept-Language": opts.extra?.["Accept-Language"] || opts.acceptLanguage || getSystemAcceptLanguage(),
-    "Accept-Encoding": "gzip, deflate, br, zstd",
-    "Content-Type": "application/json",
-    Cookie: opts.cookie,
-    Origin: qwenOrigin(),
-    Referer: opts.extra?.Referer ?? (opts.chatSessionId ? qwenUrl(`/c/${encodeURIComponent(opts.chatSessionId)}`) : qwenUrl("/")),
-    "Sec-Fetch-Dest": "empty",
-    "Sec-Fetch-Mode": "cors",
-    "Sec-Fetch-Site": "same-origin",
-    Connection: "keep-alive",
-    "User-Agent": opts.userAgent || getDefaultQwenUserAgent(),
-    "X-Request-Id": uuidv4(),
-    "bx-v": opts.bxV || "2.5.37",
-    source: "web",
-    version: opts.version || getQwenWebVersion(),
-    timezone: opts.extra?.timezone || opts.extra?.Timezone || formatAsciiTimezone(),
-    Timezone: opts.extra?.Timezone || opts.extra?.timezone || formatAsciiTimezone(),
-    // Use the real browser client-hints when captured (anti-hardcoded); fall
-    // back to the static fingerprint otherwise.
-    "sec-ch-ua": opts.secChUa || `"Google Chrome";v="${getChromeMajor()}", "Chromium";v="${getChromeMajor()}", "Not.A/Brand";v="99"`,
-    "sec-ch-ua-mobile": opts.secChUaMobile || "?0",
-    "sec-ch-ua-platform": opts.secChUaPlatform || '"Windows"'
-  };
-  const tokenMatch = opts.cookie?.match(/(?:^|;\s*)token=([^;]+)/);
-  if (tokenMatch && !headers["Authorization"] && !headers["authorization"]) {
-    const bearer = decodeURIComponent(tokenMatch[1].trim());
-    if (bearer && bearer !== '""' && bearer !== "null") {
-      headers["Authorization"] = `Bearer ${bearer}`;
-    }
-  }
-  if (config.qwen.sendBxUa) {
-    if (opts.bxUa) headers["bx-ua"] = opts.bxUa;
-    if (opts.bxUmidtoken) headers["bx-umidtoken"] = opts.bxUmidtoken;
-  }
-  return headers;
-}
-var dynamicWebVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
-var init_qwen_headers = __esm({
-  "src/services/qwen-headers.ts"() {
-    "use strict";
-    init_qwen_url();
-    init_config();
-    init_fingerprint();
-    init_timezone();
-    dynamicWebVersion = null;
-    QWEN_WEB_VERSION = config.qwen.webVersion;
-    DEFAULT_QWEN_USER_AGENT = getDefaultQwenUserAgent(151);
-    QWEN_TIMEZONE_HEADER = (/* @__PURE__ */ new Date()).toString().split(" (")[0];
-  }
-});
-
 // src/utils/jwt.ts
 var jwt_exports = {};
 __export(jwt_exports, {
@@ -3642,11 +4025,12 @@ async function getOrLaunchSharedBrowser(browserType = "chromium", headless = con
 async function clearVisibleChallenge(page) {
   if (page.isClosed()) return;
   if (config.captcha.enabled) {
-    await solveBaxiaCaptcha(page, {
+    await solveVisibleCaptcha(page, {
       waitForMs: 0,
       maxAttempts: config.captcha.maxAttempts,
       retryDelayMs: config.captcha.retryDelayMs,
-      settleMs: config.captcha.settleMs
+      settleMs: config.captcha.settleMs,
+      sliderTimeoutMs: config.captcha.sliderTimeoutMs
     }).catch(() => false);
   }
   try {
@@ -4259,6 +4643,7 @@ async function getBasicHeaders(accountId) {
               mobile = data.mobile ? "?1" : "?0";
             }
             let bundleVersion = null;
+            let baxiaVersion = null;
             try {
               const el = document.querySelector('link[href*="qwen-chat-fe"], script[src*="qwen-chat-fe"], img[src*="qwen-chat-fe"]');
               const src = el ? el.getAttribute("href") || el.getAttribute("src") || "" : "";
@@ -4266,7 +4651,14 @@ async function getBasicHeaders(accountId) {
               if (match) bundleVersion = match[1];
             } catch {
             }
-            return { ua, secChUa, platform, mobile, bundleVersion };
+            try {
+              const baxia = window.baxiaCommon;
+              if (typeof baxia?.version === "string") {
+                baxiaVersion = baxia.version;
+              }
+            } catch {
+            }
+            return { ua, secChUa, platform, mobile, bundleVersion, baxiaVersion };
           }),
           config.timeouts.page,
           `User-agent lookup timed out for ${accountId}`
@@ -4275,6 +4667,9 @@ async function getBasicHeaders(accountId) {
         if (nav.bundleVersion) {
           updateQwenWebVersion(nav.bundleVersion);
         }
+        if (nav.baxiaVersion) {
+          updateQwenBxVersion(nav.baxiaVersion);
+        }
         cachedUserAgents.set(accountId, userAgent);
         const hints = getHeaderCache(accountId).headers;
         clientHints = {
@@ -4306,7 +4701,7 @@ async function getBasicHeaders(accountId) {
       markAccountHeadersReady(accountId);
       const bxUa2 = cache.headers["bx-ua"];
       const bxUmidtoken2 = cache.headers["bx-umidtoken"];
-      const bxV2 = cache.headers["bx-v"] || "2.5.37";
+      const bxV2 = cache.headers["bx-v"] || getQwenBxVersion();
       const cookie2 = await getCookies(accountId);
       return { cookie: cookie2, userAgent, bxV: bxV2, bxUa: bxUa2, bxUmidtoken: bxUmidtoken2, ...clientHints };
     }
@@ -4317,7 +4712,7 @@ async function getBasicHeaders(accountId) {
         cookieCaches.set(accountId, { cookie: cookie2, timestamp: Date.now() });
         const bxUa2 = cache.headers["bx-ua"];
         const bxUmidtoken2 = cache.headers["bx-umidtoken"];
-        const bxV2 = cache.headers["bx-v"] || "2.5.37";
+        const bxV2 = cache.headers["bx-v"] || getQwenBxVersion();
         cache.lastRefresh = Date.now();
         markAccountHeadersReady(accountId);
         console.log(
@@ -4337,14 +4732,15 @@ async function getBasicHeaders(accountId) {
           `\u26A0\uFE0F  [Playwright] Header refresh failed for ${accountId}; retaining the previous valid cache: ${getErrorMessage(error)}`
         );
       }
-    } else if (hadUsableHeaders && headersAge > HEADER_CACHE_TTL * HEADER_REFRESH_THRESHOLD && !cache.refreshInProgress) {
-      cache.refreshInProgress = true;
+    } else if (hadUsableHeaders && headersAge > HEADER_CACHE_TTL * HEADER_REFRESH_THRESHOLD && !cache.refreshInProgress && // Header capture types into the chat input and sends a probe message on
+    // the account's page. Doing that while the account is serving a stream
+    // would mutate the live conversation (and can navigate the SPA), so the
+    // proactive refresh waits until the account has no active lease.
+    !hasActiveAccountLease(accountId)) {
       refreshHeadersInternal(accountId).catch((error) => {
         console.warn(
           `\u26A0\uFE0F  [Playwright] Background header refresh failed for ${accountId}: ${getErrorMessage(error)}`
         );
-      }).finally(() => {
-        cache.refreshInProgress = false;
       });
     }
     if (!hasRequiredQwenHeaders(cache.headers)) {
@@ -4391,6 +4787,9 @@ async function getBasicHeaders(accountId) {
             if (persisted.version) {
               updateQwenWebVersion(persisted.version);
             }
+            if (persisted.bxV) {
+              updateQwenBxVersion(persisted.bxV);
+            }
             cache.lastRefresh = persisted.capturedAt;
             markAccountHeadersReady(accountId);
           }
@@ -4418,7 +4817,7 @@ async function getBasicHeaders(accountId) {
     markAccountHeadersReady(accountId);
     const bxUa = cache.headers["bx-ua"];
     const bxUmidtoken = cache.headers["bx-umidtoken"];
-    const bxV = cache.headers["bx-v"] || "2.5.37";
+    const bxV = cache.headers["bx-v"] || getQwenBxVersion();
     cookieCaches.delete(accountId);
     const cookie = await getCookies(accountId, true);
     if (cache.headers) {
@@ -4482,8 +4881,12 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
       if (accountPages.has(account.id)) {
         return;
       }
-      await evictIdlePlaywrightContextsToLimit().catch(() => {
-      });
+      if (config.playwright.maxActiveContexts > 0) {
+        await evictIdlePlaywrightContextsToLimit(
+          Math.max(1, config.playwright.maxActiveContexts - 1)
+        ).catch(() => {
+        });
+      }
       const profilePath = getAccountProfilePath(account.id);
       const fingerprint = getFingerprintProfile(account.id);
       const { engine, channel } = resolveBrowserEngine(browserType);
@@ -4659,6 +5062,9 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
                 if (persisted.version) {
                   updateQwenWebVersion(persisted.version);
                 }
+                if (persisted.bxV) {
+                  updateQwenBxVersion(persisted.bxV);
+                }
                 cache.lastRefresh = persisted.capturedAt;
                 markAccountHeadersReady(account.id);
                 restoredFromDb = true;
@@ -4752,7 +5158,7 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
         if (!acctPage.isClosed()) {
           try {
             const currentUrl = new URL(acctPage.url());
-            if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+            if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname.includes("/auth") || currentUrl.pathname.includes("/login") || currentUrl.pathname.includes("_____tmd_____")) {
               await acctPage.goto(qwenUrl("/"), {
                 waitUntil: "domcontentloaded",
                 timeout: config.timeouts.navigation
@@ -4770,6 +5176,8 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
     } finally {
       release();
     }
+    await evictIdlePlaywrightContextsToLimit().catch(() => {
+    });
   })();
   try {
     await initPromise;
@@ -5006,7 +5414,7 @@ async function startEmailOtpLogin(email, options = {}) {
       {
         email: normalizedEmail,
         requestId,
-        version: getQwenWebVersion() || "0.3.26",
+        version: getQwenWebVersion(),
         timezone: formatAsciiTimezone()
       }
     ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
@@ -5101,7 +5509,7 @@ async function verifyEmailOtpLogin(sessionId, code) {
       email: session.email,
       code: cleanCode,
       requestId,
-      version: getQwenWebVersion() || "0.3.26",
+      version: getQwenWebVersion(),
       timezone: formatAsciiTimezone()
     }
   ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
@@ -5148,8 +5556,8 @@ async function verifyEmailOtpLogin(sessionId, code) {
     saveAuthSession2(session.accountId, {
       cookie: `token=${accessToken}`,
       userAgent: session.fingerprint.userAgent,
-      bxV: "2.5.37",
-      version: getQwenWebVersion() || "0.3.26",
+      bxV: getQwenBxVersion(),
+      version: getQwenWebVersion(),
       userId: userId || void 0,
       tokenExpiresAt: exp || void 0,
       refreshToken: refreshToken || void 0,
@@ -5259,7 +5667,7 @@ async function loginToQwen(accountId, email, password) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
-            bxV: cache.headers["bx-v"] || "2.5.37",
+            bxV: cache.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache.headers["bx-ua"] || "",
             bxUmidtoken: cache.headers["bx-umidtoken"] || "",
             secChUa: cache.headers["sec-ch-ua"] || void 0,
@@ -5331,7 +5739,7 @@ async function loginToQwen(accountId, email, password) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || "",
-            bxV: cache.headers["bx-v"] || "2.5.37",
+            bxV: cache.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache.headers["bx-ua"] || "",
             bxUmidtoken: cache.headers["bx-umidtoken"] || "",
             secChUa: cache.headers["sec-ch-ua"] || void 0,
@@ -5402,7 +5810,7 @@ async function loginViaApi(page, email, password) {
     }
     const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
     const requestId = crypto3.randomUUID();
-    const webVersion = getQwenWebVersion() || "0.3.26";
+    const webVersion = getQwenWebVersion();
     const evalRes = await page.evaluate(
       async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2, tz, version }) => {
         try {
@@ -5574,6 +5982,15 @@ async function loginViaUi(page, email, password) {
     if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3).catch(() => false)) {
       return { success: true };
     }
+    if (config.captcha.enabled) {
+      await solveVisibleCaptcha(page, {
+        waitForMs: 1500,
+        maxAttempts: config.captcha.maxAttempts,
+        retryDelayMs: config.captcha.retryDelayMs,
+        settleMs: config.captcha.settleMs,
+        sliderTimeoutMs: config.captcha.sliderTimeoutMs
+      }).catch(() => false);
+    }
     const emailSelector = [
       'input[type="email"]',
       'input[name="email"]',
@@ -5729,10 +6146,11 @@ async function loginViaUi(page, email, password) {
     while (Date.now() < postSubmitDeadline) {
       if (page.isClosed()) break;
       if (config.captcha.enabled) {
-        await solveBaxiaCaptcha(page, {
+        await solveVisibleCaptcha(page, {
           waitForMs: 1500,
           maxAttempts: config.captcha.maxAttempts,
-          retryDelayMs: config.captcha.retryDelayMs
+          retryDelayMs: config.captcha.retryDelayMs,
+          sliderTimeoutMs: config.captcha.sliderTimeoutMs
         }).catch(() => {
         });
       }
@@ -5855,7 +6273,7 @@ async function refreshAccountToken(accountId) {
   }
   if (refreshToken) {
     try {
-      const webVersion = getQwenWebVersion() || "0.3.26";
+      const webVersion = getQwenWebVersion();
       const refreshResult = await page.evaluate(
         async ({ rTok, tz, version }) => {
           try {
@@ -5920,7 +6338,7 @@ async function refreshAccountToken(accountId) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache.headers["user-agent"] || session?.userAgent || "",
-            bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxV: cache.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
             bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
             bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
             secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
@@ -5955,7 +6373,7 @@ async function refreshAccountToken(accountId) {
         saveAuthSession2(accountId, {
           cookie: cookieStr,
           userAgent: cache.headers["user-agent"] || session?.userAgent || "",
-          bxV: cache.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxV: cache.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
           bxUa: cache.headers["bx-ua"] || session?.bxUa || "",
           bxUmidtoken: cache.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
           secChUa: cache.headers["sec-ch-ua"] || session?.secChUa,
@@ -6103,7 +6521,7 @@ async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.ti
           cookie: reqHeaders["cookie"] || "",
           "bx-ua": reqHeaders["bx-ua"] || "",
           "bx-umidtoken": reqHeaders["bx-umidtoken"] || "",
-          "bx-v": reqHeaders["bx-v"] || "2.5.37",
+          "bx-v": reqHeaders["bx-v"] || getQwenBxVersion(),
           "user-agent": reqHeaders["user-agent"] || "",
           "x-request-id": reqHeaders["x-request-id"] || "",
           "version": reqHeaders["version"] || "",
@@ -6135,6 +6553,9 @@ async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.ti
         if (capturedHeaders["version"]) {
           updateQwenWebVersion(capturedHeaders["version"]);
         }
+        if (capturedHeaders["bx-v"]) {
+          updateQwenBxVersion(capturedHeaders["bx-v"]);
+        }
         markAccountHeadersReady(accountId);
         cache.lastRefresh = Date.now();
         cookieCaches.delete(accountId);
@@ -6538,19 +6959,26 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
         await executeReauth();
       } else {
         try {
-          await page.goto(qwenUrl("/"), {
-            waitUntil: "domcontentloaded",
-            timeout: Math.min(
-              config.timeouts.navigation,
-              boundedTimeoutMs,
-              SESSION_PROBE_NAVIGATION_TIMEOUT_MS
-            )
-          });
-          await sleep2(2e3);
-          const url = page.url();
+          const currentUrl = typeof page.url === "function" ? page.url() : "";
+          const needsNavigation = !currentUrl.startsWith(qwenOrigin()) || currentUrl.includes("/auth") || currentUrl.includes("/login") || currentUrl.includes("_____tmd_____");
+          if (needsNavigation) {
+            await page.goto(qwenUrl("/"), {
+              waitUntil: "domcontentloaded",
+              timeout: Math.min(
+                config.timeouts.navigation,
+                boundedTimeoutMs,
+                SESSION_PROBE_NAVIGATION_TIMEOUT_MS
+              )
+            });
+            await sleep2(2e3);
+          }
+          const url = typeof page.url === "function" ? page.url() : "";
           const isAuthUrl = url.includes("auth") || url.includes("login");
           if (isAuthUrl) {
-            await executeReauth();
+            const refreshed = await refreshAccountToken(accountId);
+            if (!refreshed.success) {
+              await executeReauth();
+            }
           }
         } catch (navErr) {
           console.warn(
@@ -6585,7 +7013,7 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
             saveAuthSession2(accountId, {
               cookie: cookieStr,
               userAgent: cache.headers["user-agent"] || "",
-              bxV: cache.headers["bx-v"] || "2.5.37",
+              bxV: cache.headers["bx-v"] || getQwenBxVersion(),
               bxUa: cache.headers["bx-ua"] || "",
               bxUmidtoken: cache.headers["bx-umidtoken"] || "",
               secChUa: cache.headers["sec-ch-ua"] || void 0,
@@ -6607,7 +7035,7 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
     if (capturedPage && !capturedPage.isClosed()) {
       try {
         const currentUrl = new URL(capturedPage.url());
-        if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+        if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname.includes("/auth") || currentUrl.pathname.includes("/login") || currentUrl.pathname.includes("_____tmd_____")) {
           await capturedPage.goto(qwenUrl("/"), {
             waitUntil: "domcontentloaded",
             timeout: Math.min(config.timeouts.navigation, boundedTimeoutMs)
@@ -6923,7 +7351,11 @@ function priorityOrderForEviction(accountIds) {
   const ranked = getAccountsByPriority(accountIds.map((id) => ({ id })));
   const rank = /* @__PURE__ */ new Map();
   for (const [index, account] of ranked.entries()) {
-    rank.set(account.id, index);
+    if (getAccountCooldownInfo(account.id)) {
+      rank.set(account.id, Number.MAX_SAFE_INTEGER);
+    } else {
+      rank.set(account.id, index);
+    }
   }
   return orderContextsForEviction(
     accountIds,
@@ -6960,14 +7392,15 @@ async function closeIdlePlaywrightAccounts(idleMs) {
   }
   return closed;
 }
-async function evictIdlePlaywrightContextsToLimit() {
-  const max = config.playwright.maxActiveContexts;
-  if (max <= 0) return 0;
+async function evictIdlePlaywrightContextsToLimit(targetLimit) {
+  const configuredMax = config.playwright.maxActiveContexts;
+  if (configuredMax <= 0) return 0;
+  const max = targetLimit !== void 0 ? Math.max(0, targetLimit) : configuredMax;
   if (accountPages.size <= max) return 0;
   const candidates = priorityOrderForEviction(
     Array.from(accountPages.keys()).filter((accountId) => {
       if (isAccountServingStream(accountId)) return false;
-      if (isAccountRecentlyActive(accountId, 3e4)) return false;
+      if (hasActiveAccountLease(accountId)) return false;
       const mutex = accountMutexes.get(accountId);
       return mutex?.isIdle();
     })
@@ -6980,6 +7413,7 @@ async function evictIdlePlaywrightContextsToLimit() {
   for (const candidate of candidates) {
     if (accountPages.size <= max) break;
     if (isAccountServingStream(candidate.accountId)) continue;
+    if (hasActiveAccountLease(candidate.accountId)) continue;
     const mutex = accountMutexes.get(candidate.accountId);
     if (!mutex?.isIdle()) continue;
     await closePlaywrightForAccount(candidate.accountId).catch((error) => {
@@ -7343,13 +7777,13 @@ async function getBasicHeaders2(accountId) {
     return {
       cookie: "token=mock",
       userAgent: "mock",
-      bxV: "2.5.37",
+      bxV: getQwenBxVersion(),
       bxUa: "mock-bx-ua",
       bxUmidtoken: "mock-bx-umidtoken",
       secChUa: "",
       secChUaMobile: "?0",
       secChUaPlatform: "",
-      version: "0.3.26"
+      version: getQwenWebVersion()
     };
   }
   const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
@@ -7410,6 +7844,7 @@ var init_auth_playwright = __esm({
     init_errors();
     init_accounts();
     init_config();
+    init_qwen_headers();
     init_playwright();
     init_jwt();
   }
@@ -7818,6 +8253,7 @@ var init_model_registry = __esm({
 var captcha_coordinator_exports = {};
 __export(captcha_coordinator_exports, {
   isCaptchaRecoveryActive: () => isCaptchaRecoveryActive,
+  isCaptchaRecoveryInBackoff: () => isCaptchaRecoveryInBackoff,
   recoverBaxiaCaptcha: () => recoverBaxiaCaptcha,
   solveChallengeOnPage: () => solveChallengeOnPage
 });
@@ -7837,9 +8273,10 @@ async function solveChallengeOnPage(page, challengeUrl, waitForMs = config.captc
   const solverOptions = {
     maxAttempts: config.captcha.maxAttempts,
     retryDelayMs: config.captcha.retryDelayMs,
-    settleMs: config.captcha.settleMs
+    settleMs: config.captcha.settleMs,
+    sliderTimeoutMs: config.captcha.sliderTimeoutMs
   };
-  if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+  if (await solveVisibleCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
     return true;
   }
   logBaxiaCaptcha(
@@ -7849,13 +8286,18 @@ async function solveChallengeOnPage(page, challengeUrl, waitForMs = config.captc
   );
   await gotoBestEffort(page, challengeUrl ?? qwenUrl("/"));
   try {
-    return await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs });
+    return await solveVisibleCaptcha(page, { ...solverOptions, waitForMs });
   } finally {
     if (page.url().includes(CHALLENGE_PATH_MARKER)) {
       await gotoBestEffort(page, qwenUrl("/"));
     }
   }
 }
+function isCaptchaRecoveryInBackoff(accountId) {
+  if (!accountId) return false;
+  const lastFailure = lastFailedRecoveryAt.get(accountId) ?? 0;
+  return Date.now() - lastFailure < FAILED_RECOVERY_BACKOFF_MS;
+}
 async function recoverBaxiaCaptcha(accountId, label, options = {}) {
   if (!config.captcha.enabled || !accountId) return false;
   const solver = "baxia";
@@ -7873,17 +8315,35 @@ async function recoverBaxiaCaptcha(accountId, label, options = {}) {
   const challengeUrl = options.challengeBody ? extractBaxiaChallengeUrl(options.challengeBody, config.qwen.baseUrl) : null;
   activeCaptchaRecoveries.add(accountId);
   try {
-    const { abortActiveBrowserStreamsForAccount: abortActiveBrowserStreamsForAccount2 } = await Promise.resolve().then(() => (init_qwen(), qwen_exports));
-    abortActiveBrowserStreamsForAccount2(
-      accountId,
-      "Account stream interrupted by captcha challenge recovery"
-    );
-  } catch {
-  }
-  try {
+    const { hasActiveBrowserStreamsForAccount: hasActiveBrowserStreamsForAccount2 } = await Promise.resolve().then(() => (init_qwen(), qwen_exports));
+    const hasConcurrentStream = hasActiveBrowserStreamsForAccount2(accountId);
     const solved = await withAccountPage(
       accountId,
-      (page) => solveChallengeOnPage(page, challengeUrl),
+      async (page) => {
+        if (hasConcurrentStream) {
+          const solverOptions = {
+            maxAttempts: config.captcha.maxAttempts,
+            retryDelayMs: config.captcha.retryDelayMs,
+            settleMs: config.captcha.settleMs,
+            sliderTimeoutMs: config.captcha.sliderTimeoutMs
+          };
+          if (await solveVisibleCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+            return true;
+          }
+          const ctx = typeof page.context === "function" ? page.context() : null;
+          if (ctx && typeof ctx.newPage === "function") {
+            const tempPage = await ctx.newPage();
+            try {
+              return await solveChallengeOnPage(tempPage, challengeUrl);
+            } finally {
+              await tempPage.close({ runBeforeUnload: false }).catch(() => {
+              });
+            }
+          }
+          return false;
+        }
+        return await solveChallengeOnPage(page, challengeUrl);
+      },
       solverOperationTimeoutMs,
       solverOperationTimeoutMs,
       false
@@ -8384,7 +8844,7 @@ var init_media_generation = __esm({
 
 // src/services/qwen-chat-pool.ts
 import crypto4 from "crypto";
-async function createQwenChatSession(headers, model, accountId, chatMode = "thread") {
+async function createQwenChatSession(headers, model, accountId, chatMode = "thread", captchaRecoveryAttempts = 1) {
   if (isAuthMockEnabled()) {
     return process.env.TEST_SESSION_ID || "mock-session";
   }
@@ -8412,16 +8872,29 @@ async function createQwenChatSession(headers, model, accountId, chatMode = "thre
   if (!chatId || typeof chatId !== "string") {
     const rawLower = raw.toLowerCase();
     if (looksLikeAntiBotChallengeText(raw)) {
-      try {
-        const { recoverBaxiaCaptcha: recoverBaxiaCaptcha2 } = await Promise.resolve().then(() => (init_captcha_coordinator(), captcha_coordinator_exports));
-        const solved = await recoverBaxiaCaptcha2(accountId, "createQwenChatSession", {
-          challengeBody: raw
-        });
-        if (solved) {
-          return createQwenChatSession(headers, model, accountId, chatMode);
+      if (captchaRecoveryAttempts > 0) {
+        try {
+          const { recoverBaxiaCaptcha: recoverBaxiaCaptcha2 } = await Promise.resolve().then(() => (init_captcha_coordinator(), captcha_coordinator_exports));
+          const solved = await recoverBaxiaCaptcha2(accountId, "createQwenChatSession", {
+            challengeBody: raw
+          });
+          if (solved) {
+            return createQwenChatSession(
+              headers,
+              model,
+              accountId,
+              chatMode,
+              captchaRecoveryAttempts - 1
+            );
+          }
+        } catch {
         }
-      } catch {
       }
+      throw new QwenUpstreamError(
+        `Qwen create chat blocked by WAF challenge: ${raw.substring(0, 300)}`,
+        "FAIL_SYS_USER_VALIDATE",
+        403
+      );
     }
     const isUnauthorized = json?.data?.code?.toLowerCase() === "unauthorized" || json?.code?.toLowerCase() === "unauthorized" || rawLower.includes("unauthorized") || rawLower.includes("permission to access") || rawLower.includes("token has expired") || rawLower.includes("401");
     if (isUnauthorized) {
@@ -8598,6 +9071,20 @@ async function refillQwenChatPool(headers, model, accountId) {
         console.warn(
           `[WarmPool] Account ${accountId || "global"} rate-limited during chat creation. Marked for cooldown.`
         );
+      } else if (accountId && (err.upstreamCode === "FAIL_SYS_USER_VALIDATE" || err.upstreamCode === "RGV587_ERROR" || /_____tmd_____|rgv587_error|fail_sys_user_validate/i.test(
+        err.message
+      ))) {
+        const existing = getAccountCooldownInfo(accountId);
+        if (existing?.reason === "WafChallenge") {
+          console.warn(
+            `[WarmPool] Account ${accountId} still on WAF quarantine (${Math.ceil(existing.remainingMs / 1e3)}s left); skipping re-escalation.`
+          );
+        } else {
+          const block = recordWafHardBlock(accountId);
+          console.warn(
+            `[WarmPool] Unsolved WAF challenge on ${accountId} during chat creation; quarantined ${Math.ceil(block.cooldownMs / 1e3)}s and rotated the fingerprint.`
+          );
+        }
       }
     }
     if (isToolcallDebugEnabled()) {
@@ -8633,6 +9120,7 @@ var init_qwen_chat_pool = __esm({
     init_config();
     init_logger();
     init_account_manager();
+    init_waf_isolation();
     init_model_alias();
     init_qwen_url();
     init_qwen_errors();
@@ -8682,6 +9170,7 @@ __export(qwen_exports, {
   getLogicalThreadState: () => getLogicalThreadState,
   getQwenErrorCode: () => getQwenErrorCode,
   getSessionParent: () => getSessionParent,
+  hasActiveBrowserStreamsForAccount: () => hasActiveBrowserStreamsForAccount,
   invalidateLogicalThreadParent: () => invalidateLogicalThreadParent,
   isChatSessionActive: () => isChatSessionActive,
   isRetryableFetchErrorMessage: () => isRetryableFetchErrorMessage,
@@ -8703,6 +9192,14 @@ __export(qwen_exports, {
 });
 import crypto5 from "crypto";
 import { v4 as uuidv43 } from "uuid";
+function hasActiveBrowserStreamsForAccount(accountId) {
+  for (const state of browserStreamStates.values()) {
+    if (state.accountId === accountId && !state.done) {
+      return true;
+    }
+  }
+  return false;
+}
 function abortActiveBrowserStreamsForAccount(accountId, reason = "Account browser stream interrupted (page context unloaded)") {
   let count = 0;
   for (const [requestId, state] of browserStreamStates) {
@@ -9193,7 +9690,7 @@ async function requestQwenTextInBrowser(accountId, method, path6, headers, body,
     browserHeaders["Content-Type"] = "application/json";
   }
   const evaluateRequest = (page) => page.evaluate(
-    async ({ url: url2, method: method2, headers: headers2, body: body2, referrer, timeoutMs, tz }) => {
+    async ({ url: url2, method: method2, headers: headers2, body: body2, referrer, timeoutMs, tz, version }) => {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
       try {
@@ -9215,7 +9712,7 @@ async function requestQwenTextInBrowser(accountId, method, path6, headers, body,
                 headers: {
                   accept: "application/json, text/plain, */*",
                   source: "web",
-                  version: "0.3.11",
+                  version,
                   "x-request-origin": "https://chat.qwen.ai",
                   timezone: tz,
                   authorization: `Bearer ${rTok}`
@@ -9263,7 +9760,8 @@ async function requestQwenTextInBrowser(accountId, method, path6, headers, body,
       body,
       referrer: options.referrer,
       timeoutMs: options.timeoutMs ?? Math.min(config.timeouts.page, 2e4),
-      tz: formatAsciiTimezone()
+      tz: formatAsciiTimezone(),
+      version: getQwenWebVersion()
     }
   );
   const recoverOnTimeout = !options.noMutexRecovery;
@@ -9480,7 +9978,7 @@ async function createQwenBrowserResponse(accountId, url, method, headers, body,
           const onFrameNavigated = (frame) => {
             if (!settled && typeof page.mainFrame === "function" && frame === page.mainFrame()) {
               const url2 = typeof frame.url === "function" ? frame.url() : String(frame.url || "");
-              if (url2.startsWith(qwenOrigin()) && !url2.includes("/auth") && !url2.includes("_____tmd_____") && !url2.includes("/punish")) {
+              if (url2.startsWith(qwenOrigin()) && !url2.includes("/auth") && !url2.includes("/login") && !url2.includes("_____tmd_____") && !url2.includes("/punish")) {
                 return;
               }
               handleBrowserStreamEvent(requestId, {
@@ -9501,10 +9999,12 @@ async function createQwenBrowserResponse(accountId, url, method, headers, body,
           };
           page.on("framenavigated", onFrameNavigated);
           page.on("close", onPageClosed);
+          page.on("crash", onPageClosed);
           pageCleanup = () => {
             try {
               page.off?.("framenavigated", onFrameNavigated);
               page.off?.("close", onPageClosed);
+              page.off?.("crash", onPageClosed);
             } catch {
             }
           };
@@ -10218,7 +10718,7 @@ async function deleteSingleQwenChat(accountId, chatId) {
   }
   const requestHeaders = {
     source: "web",
-    version: getQwenWebVersion() || "0.3.26",
+    version: getQwenWebVersion(),
     timezone: formatAsciiTimezone(),
     "x-request-id": crypto5.randomUUID(),
     Referer: qwenUrl(`/c/${encodeURIComponent(chatId)}`)
@@ -10262,7 +10762,7 @@ async function fetchRemoteQwenChats(accountId) {
     return [];
   }
   const requestHeaders = {
-    version: getQwenWebVersion() || "0.3.26",
+    version: getQwenWebVersion(),
     timezone: formatAsciiTimezone(),
     "x-request-id": crypto5.randomUUID(),
     Referer: qwenUrl("/settings/chats")
@@ -11292,6 +11792,7 @@ async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false) {
       const account = accounts[i];
       const currentIdx = i + 1;
       const totalCount = accounts.length;
+      const wasInitialized = isPlaywrightInitialized(account.id);
       try {
         const ok = await deleteChatsForAccount(account, currentIdx, totalCount);
         if (ok) succeeded++;
@@ -11301,7 +11802,7 @@ async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false) {
           error instanceof Error ? error.message : String(error)
         );
       } finally {
-        if (!keepBrowserOpen) {
+        if ((!keepBrowserOpen || !wasInitialized) && !isAuthMockEnabled()) {
           const { closePlaywrightForAccount: closePlaywrightForAccount2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
           await closePlaywrightForAccount2(account.id).catch(() => {
           });