qwenproxy-cli 1.6.10 → 1.6.12

package/dist/index.js

@@ -266,7 +266,7 @@ var init_config = __esm({
       // Version header on Qwen API requests = the deployed web bundle version
       // (fallback when dynamic DOM detection is not yet completed).
       // Override via env when Qwen ships a new bundle.
-      QWEN_WEB_VERSION: z.string().default("0.3.26"),
+      QWEN_WEB_VERSION: z.string().default("0.3.43"),
       // Controls bx-ua/bx-umidtoken injection on the GENERAL API paths
       // (chats/new, settings): those work without them (live-probed). The
       // completions path is the exception — the 0.2.86 HAR shows the real
@@ -309,6 +309,7 @@ var init_config = __esm({
       CAPTCHA_SOLVER_ENABLED: z.string().default("true"),
       CAPTCHA_SOLVER_MAX_ATTEMPTS: z.string().default("3"),
       CAPTCHA_SOLVER_TIMEOUT_MS: z.string().default("15000"),
+      CAPTCHA_SLIDER_TIMEOUT_MS: z.string().default("8000"),
       CAPTCHA_SOLVER_RETRY_DELAY_MS: z.string().default("1000"),
       CAPTCHA_SOLVER_SETTLE_MS: z.string().default("2000"),
       CAPTCHA_ACCOUNT_COOLDOWN_MS: z.string().default("120000"),
@@ -460,6 +461,8 @@ var init_config = __esm({
         enabled: env.CAPTCHA_SOLVER_ENABLED === "true",
         maxAttempts: Math.max(1, Math.min(5, parseInt(env.CAPTCHA_SOLVER_MAX_ATTEMPTS))),
         timeoutMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_TIMEOUT_MS)),
+        /** Max wait for a challenge slider to become visible (slow WAF renders). */
+        sliderTimeoutMs: Math.max(500, parseInt(env.CAPTCHA_SLIDER_TIMEOUT_MS)),
         retryDelayMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_RETRY_DELAY_MS)),
         settleMs: Math.max(0, parseInt(env.CAPTCHA_SOLVER_SETTLE_MS)),
         /** Rest an account whose challenge could not be cleared before reusing it. */
@@ -3619,6 +3622,294 @@ function extractBaxiaChallengeUrl(body, baseUrl) {
   }
   return null;
 }
+async function findVisibleLocatorWithin(page, selectors, timeoutMs) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  while (true) {
+    const found = await findVisibleLocator(page, selectors);
+    if (found) return found;
+    if (Date.now() >= deadline) return null;
+    await sleep(Math.min(150, Math.max(1, deadline - Date.now())));
+  }
+}
+async function waitForHidden(locator, timeoutMs) {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  while (true) {
+    if (!await isVisible(locator)) return true;
+    if (Date.now() >= deadline) return false;
+    await sleep(Math.min(100, Math.max(1, deadline - Date.now())));
+  }
+}
+async function computeAliyunPuzzleOffset(page) {
+  return page.evaluate(() => {
+    const background = document.querySelector(
+      "#aliyunCaptcha-img"
+    );
+    const piece = document.querySelector(
+      "#aliyunCaptcha-puzzle"
+    );
+    if (!background || !piece) {
+      return Promise.resolve({ ok: false, reason: "missing puzzle images" });
+    }
+    const compute = () => {
+      try {
+        const width = background.naturalWidth;
+        const height = background.naturalHeight;
+        const pieceWidth = piece.naturalWidth;
+        const pieceHeight = piece.naturalHeight;
+        if (!width || !height || !pieceWidth || !pieceHeight) {
+          return { ok: false, reason: "image dimensions unavailable" };
+        }
+        const backgroundCanvas = document.createElement("canvas");
+        backgroundCanvas.id = "captcha-solver-canvas";
+        backgroundCanvas.width = width;
+        backgroundCanvas.height = height;
+        const backgroundContext = backgroundCanvas.getContext("2d");
+        if (!backgroundContext) {
+          return { ok: false, reason: "no background context" };
+        }
+        const pieceCanvas = document.createElement("canvas");
+        pieceCanvas.id = "captcha-solver-canvas";
+        pieceCanvas.width = pieceWidth;
+        pieceCanvas.height = pieceHeight;
+        const pieceContext = pieceCanvas.getContext("2d");
+        if (!pieceContext) {
+          return { ok: false, reason: "no piece context" };
+        }
+        try {
+          backgroundContext.drawImage(background, 0, 0);
+        } catch {
+          return { ok: false, reason: "background canvas tainted" };
+        }
+        try {
+          pieceContext.drawImage(piece, 0, 0);
+        } catch {
+          return { ok: false, reason: "puzzle canvas tainted" };
+        }
+        const backgroundData = backgroundContext.getImageData(
+          0,
+          0,
+          width,
+          height
+        ).data;
+        const pieceData = pieceContext.getImageData(
+          0,
+          0,
+          pieceWidth,
+          pieceHeight
+        ).data;
+        let pieceMinX = pieceWidth;
+        let pieceMaxX = -1;
+        let pieceMinY = pieceHeight;
+        let pieceMaxY = -1;
+        for (let y = 0; y < pieceHeight; y++) {
+          for (let x = 0; x < pieceWidth; x++) {
+            if (pieceData[(y * pieceWidth + x) * 4 + 3] > 100) {
+              if (x < pieceMinX) pieceMinX = x;
+              if (x > pieceMaxX) pieceMaxX = x;
+              if (y < pieceMinY) pieceMinY = y;
+              if (y > pieceMaxY) pieceMaxY = y;
+            }
+          }
+        }
+        const puzzleWidth = pieceMaxX - pieceMinX + 1;
+        if (puzzleWidth <= 0) {
+          return { ok: false, reason: "empty puzzle piece" };
+        }
+        const yStart = Math.max(1, Math.min(height - 2, pieceMinY + 5));
+        const yEnd = Math.max(
+          yStart,
+          Math.min(height - 2, pieceMaxY - 5)
+        );
+        const columnGradients = new Float32Array(width);
+        for (let x = 1; x < width - 1; x++) {
+          let gradient = 0;
+          for (let y = yStart; y <= yEnd; y++) {
+            const left = (y * width + x - 1) * 4;
+            const right = (y * width + x + 1) * 4;
+            gradient += Math.abs(backgroundData[right] - backgroundData[left]) + Math.abs(backgroundData[right + 1] - backgroundData[left + 1]) + Math.abs(backgroundData[right + 2] - backgroundData[left + 2]);
+          }
+          columnGradients[x] = gradient;
+        }
+        let bestX = 0;
+        let bestScore = 0;
+        const minCandidateX = 30;
+        const maxCandidateX = width - puzzleWidth - 20;
+        for (let candidateX = minCandidateX; candidateX <= maxCandidateX; candidateX++) {
+          let leftMax = 0;
+          for (let dx = -2; dx <= 2; dx++) {
+            const value = columnGradients[candidateX + pieceMinX + dx] || 0;
+            if (value > leftMax) leftMax = value;
+          }
+          let rightMax = 0;
+          for (let dx = -3; dx <= 1; dx++) {
+            const value = columnGradients[candidateX + pieceMaxX + dx] || 0;
+            if (value > rightMax) rightMax = value;
+          }
+          const score = Math.sqrt(leftMax * rightMax);
+          if (score > bestScore) {
+            bestScore = score;
+            bestX = candidateX;
+          }
+        }
+        if (bestScore <= 0) {
+          return { ok: false, reason: "no matching hole edge" };
+        }
+        return {
+          ok: true,
+          offsetX: bestX - pieceMinX,
+          naturalWidth: width
+        };
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : String(error)
+        };
+      }
+    };
+    return new Promise((resolve) => {
+      if (background.complete && piece.complete) {
+        resolve(compute());
+        return;
+      }
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        resolve(compute());
+      };
+      const fail = () => {
+        if (settled) return;
+        settled = true;
+        resolve({ ok: false, reason: "puzzle image load error" });
+      };
+      background.addEventListener("load", finish, { once: true });
+      piece.addEventListener("load", finish, { once: true });
+      background.addEventListener("error", fail, { once: true });
+      piece.addEventListener("error", fail, { once: true });
+      setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        resolve({ ok: false, reason: "puzzle image load timeout" });
+      }, 2e3);
+    });
+  });
+}
+async function solveAliyunWafCaptcha(page, options = {}) {
+  const waitForMs = Math.max(0, options.waitForMs ?? 0);
+  const maxAttempts = Math.max(
+    1,
+    Math.min(5, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS)
+  );
+  const retryDelayMs = Math.max(
+    0,
+    options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS
+  );
+  const settleMs = Math.max(0, options.settleMs ?? DEFAULT_SETTLE_MS);
+  const sliderTimeoutMs = Math.max(
+    500,
+    options.sliderTimeoutMs ?? DEFAULT_SLIDER_TIMEOUT_MS
+  );
+  const detected = await findVisibleLocatorWithin(
+    page,
+    ALIYUN_WAF_BLOCK_SELECTORS,
+    waitForMs
+  );
+  if (!detected) return false;
+  return withCaptchaMouseLock(async () => {
+    const block = detected.locator;
+    if (!await isVisible(block)) return false;
+    logBaxiaCaptcha("aliyun_detected", { selector: detected.selector });
+    let lastReason = "unknown";
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        const offset = await computeAliyunPuzzleOffset(page);
+        if (!offset.ok || typeof offset.offsetX !== "number" || typeof offset.naturalWidth !== "number" || offset.naturalWidth <= 0) {
+          lastReason = offset.reason || "offset_unavailable";
+          logBaxiaCaptcha("aliyun_offset_failed", {
+            attempt,
+            reason: lastReason
+          });
+        } else {
+          const slider = page.locator(ALIYUN_PUZZLE_SLIDER_SELECTOR).first();
+          const track = page.locator(ALIYUN_PUZZLE_TRACK_SELECTOR).first();
+          await slider.waitFor({ state: "visible", timeout: sliderTimeoutMs });
+          const [sliderBox, trackBox] = await Promise.all([
+            slider.boundingBox(),
+            track.boundingBox()
+          ]);
+          if (!sliderBox || !trackBox || trackBox.width <= 0) {
+            lastReason = "bounds_unavailable";
+            logBaxiaCaptcha("aliyun_offset_failed", {
+              attempt,
+              reason: lastReason
+            });
+          } else {
+            const scale = trackBox.width / offset.naturalWidth;
+            const dragDistance = Math.round(offset.offsetX * scale);
+            logBaxiaCaptcha("aliyun_geometry", {
+              attempt,
+              offset: offset.offsetX,
+              scale: Number(scale.toFixed(2)),
+              distance: dragDistance
+            });
+            if (dragDistance <= 0) {
+              lastReason = "non_positive_distance";
+            } else {
+              const startX = sliderBox.x + sliderBox.width / 2;
+              const startY = sliderBox.y + sliderBox.height / 2;
+              await humanDrag(
+                page,
+                startX,
+                startY,
+                startX + dragDistance,
+                startY
+              );
+              if (await waitForHidden(block, settleMs)) {
+                logBaxiaCaptcha(
+                  "aliyun_solve_succeeded",
+                  { attempt, distance: dragDistance },
+                  true
+                );
+                return true;
+              }
+              lastReason = "not_solved";
+            }
+          }
+        }
+      } catch (error) {
+        lastReason = error instanceof Error ? error.name : "UnknownError";
+        logBaxiaCaptcha("aliyun_offset_failed", {
+          attempt,
+          error: lastReason,
+          detail: sanitizeCaptchaErrorDetail(error)
+        });
+      }
+      if (attempt < maxAttempts && retryDelayMs > 0) {
+        await sleep(retryDelayMs);
+      }
+    }
+    logBaxiaCaptcha(
+      "aliyun_solve_failed",
+      { attempts: maxAttempts, reason: lastReason },
+      true
+    );
+    return false;
+  });
+}
+async function solveVisibleCaptcha(page, options = {}) {
+  if (typeof page.isClosed === "function" && page.isClosed()) return false;
+  const totalWaitMs = Math.max(0, options.waitForMs ?? 0);
+  const aliyunWaitMs = Math.min(totalWaitMs, ALIYUN_PROBE_MAX_WAIT_MS);
+  const startedAt = Date.now();
+  if (await solveAliyunWafCaptcha(page, { ...options, waitForMs: aliyunWaitMs })) {
+    return true;
+  }
+  const remainingWaitMs = Math.max(
+    0,
+    totalWaitMs - (Date.now() - startedAt)
+  );
+  return solveBaxiaCaptcha(page, { ...options, waitForMs: remainingWaitMs });
+}
 async function isVisible(locator) {
   return locator.isVisible().catch(() => false);
 }
@@ -3888,7 +4179,7 @@ function startBaxiaCaptchaWatcher(page, timeoutMs, options = {}) {
     promise
   };
 }
-var BAXIA_DIALOG_SELECTOR, BAXIA_CONTENT_SELECTOR, CAPTCHA_EVENT_EMOJI, captchaDebugEnabled, BAXIA_IFRAME_SELECTORS, BAXIA_DOCUMENT_SELECTORS, BAXIA_IFRAME_SELECTOR, BAXIA_SLIDER_SELECTOR, BAXIA_TRACK_SELECTOR, BAXIA_SUCCESS_SELECTOR, BAXIA_RELOAD_SELECTOR, DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_SETTLE_MS, DEFAULT_SLIDER_TIMEOUT_MS, captchaMouseLock;
+var BAXIA_DIALOG_SELECTOR, BAXIA_CONTENT_SELECTOR, CAPTCHA_EVENT_EMOJI, captchaDebugEnabled, BAXIA_IFRAME_SELECTORS, BAXIA_DOCUMENT_SELECTORS, BAXIA_IFRAME_SELECTOR, BAXIA_SLIDER_SELECTOR, BAXIA_TRACK_SELECTOR, BAXIA_SUCCESS_SELECTOR, BAXIA_RELOAD_SELECTOR, DEFAULT_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_SETTLE_MS, DEFAULT_SLIDER_TIMEOUT_MS, ALIYUN_WAF_CAPTCHA_SELECTOR, ALIYUN_WAF_CAPTCHA_WIDGET, ALIYUN_WAF_BLOCK_SELECTORS, ALIYUN_PUZZLE_SLIDER_SELECTOR, ALIYUN_PUZZLE_TRACK_SELECTOR, ALIYUN_PROBE_MAX_WAIT_MS, captchaMouseLock;
 var init_captcha_solver = __esm({
   "src/services/captcha-solver.ts"() {
     "use strict";
@@ -3914,14 +4205,20 @@ var init_captcha_solver = __esm({
       solve_failed: "\u274C",
       recovery_succeeded: "\u2705",
       recovery_not_solved: "\u26A0\uFE0F",
-      recovery_failed: "\u274C"
+      recovery_failed: "\u274C",
+      aliyun_detected: "\u{1F9E9}",
+      aliyun_offset_failed: "\u{1F4D0}",
+      aliyun_geometry: "\u{1F4D0}",
+      aliyun_solve_succeeded: "\u2705",
+      aliyun_solve_failed: "\u274C"
     };
     captchaDebugEnabled = process.env.CAPTCHA_DEBUG === "true";
     BAXIA_IFRAME_SELECTORS = [
       `${BAXIA_DIALOG_SELECTOR} ${BAXIA_CONTENT_SELECTOR} iframe`,
       `${BAXIA_CONTENT_SELECTOR} iframe`,
       "iframe#baxia-dialog-content",
-      'iframe[src*="_____tmd_____/punish"]'
+      'iframe[src*="_____tmd_____/punish"]',
+      'iframe[src*="nocaptcha"]'
     ];
     BAXIA_DOCUMENT_SELECTORS = [
       "#nocaptcha",
@@ -3929,14 +4226,23 @@ var init_captcha_solver = __esm({
       "#baxia-punish"
     ];
     BAXIA_IFRAME_SELECTOR = BAXIA_IFRAME_SELECTORS.join(", ");
-    BAXIA_SLIDER_SELECTOR = "#nc_1_n1z, .nc_1_n1z, .btn_slide, .nc_wrapper .btn_slide, ._nc .btn_slide, .nc-container .btn_slide";
-    BAXIA_TRACK_SELECTOR = "#nc_1_n1t, .nc_scale, .nc_wrapper .nc_scale, ._nc .nc_scale, .nc-container .nc_scale";
+    BAXIA_SLIDER_SELECTOR = '#nc_1_n1z, .nc_1_n1z, .btn_slide, .nc_iconfont.btn_slide, span[id*="_n1z"], .nc_wrapper .btn_slide, ._nc .btn_slide, .nc-container .btn_slide';
+    BAXIA_TRACK_SELECTOR = '#nc_1_n1t, .nc_scale, span[id*="_n1t"], .nc_wrapper .nc_scale, ._nc .nc_scale, .nc-container .nc_scale';
     BAXIA_SUCCESS_SELECTOR = '.btn_ok, .nc_ok, .nc_success, .nc_result, .nc_wrapper.nc-success, .nc_wrapper.success, [data-nc-lang="SUCCESS"], [data-nc-lang="success"], #nc-loading-circle';
     BAXIA_RELOAD_SELECTOR = '#nc_1_refresh1, .errloading a, .nc-container .errloading a, .btn_refresh, .clickCaptcha_text .btn_refresh, [data-nc-lang="REFRESH"], a[id*="refresh"]';
     DEFAULT_MAX_ATTEMPTS = 3;
     DEFAULT_RETRY_DELAY_MS = 1e3;
     DEFAULT_SETTLE_MS = 2e3;
     DEFAULT_SLIDER_TIMEOUT_MS = 8e3;
+    ALIYUN_WAF_CAPTCHA_SELECTOR = "#waf_nc_block";
+    ALIYUN_WAF_CAPTCHA_WIDGET = "#aliyunCaptcha-window-embed";
+    ALIYUN_WAF_BLOCK_SELECTORS = [
+      ALIYUN_WAF_CAPTCHA_SELECTOR,
+      ALIYUN_WAF_CAPTCHA_WIDGET
+    ];
+    ALIYUN_PUZZLE_SLIDER_SELECTOR = "#aliyunCaptcha-sliding-slider";
+    ALIYUN_PUZZLE_TRACK_SELECTOR = "#aliyunCaptcha-sliding-body";
+    ALIYUN_PROBE_MAX_WAIT_MS = 2e3;
     captchaMouseLock = Promise.resolve();
   }
 });
@@ -4090,6 +4396,14 @@ function updateQwenWebVersion(version) {
 function getQwenWebVersion() {
   return dynamicWebVersion || config.qwen.webVersion;
 }
+function updateQwenBxVersion(version) {
+  if (version && typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
+    dynamicBxVersion = version.trim();
+  }
+}
+function getQwenBxVersion() {
+  return dynamicBxVersion || config.auth.bxV;
+}
 function buildQwenRequestHeaders(opts) {
   const headers = {
     ...opts.extra ?? {},
@@ -4106,7 +4420,7 @@ function buildQwenRequestHeaders(opts) {
     Connection: "keep-alive",
     "User-Agent": opts.userAgent || getDefaultQwenUserAgent(),
     "X-Request-Id": uuidv4(),
-    "bx-v": opts.bxV || "2.5.37",
+    "bx-v": opts.bxV || getQwenBxVersion(),
     source: "web",
     version: opts.version || getQwenWebVersion(),
     timezone: opts.extra?.timezone || opts.extra?.Timezone || formatAsciiTimezone(),
@@ -4130,7 +4444,7 @@ function buildQwenRequestHeaders(opts) {
   }
   return headers;
 }
-var dynamicWebVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
+var dynamicWebVersion, dynamicBxVersion, QWEN_WEB_VERSION, DEFAULT_QWEN_USER_AGENT, QWEN_TIMEZONE_HEADER;
 var init_qwen_headers = __esm({
   "src/services/qwen-headers.ts"() {
     "use strict";
@@ -4139,6 +4453,7 @@ var init_qwen_headers = __esm({
     init_fingerprint();
     init_timezone();
     dynamicWebVersion = null;
+    dynamicBxVersion = null;
     QWEN_WEB_VERSION = config.qwen.webVersion;
     DEFAULT_QWEN_USER_AGENT = getDefaultQwenUserAgent(151);
     QWEN_TIMEZONE_HEADER = (/* @__PURE__ */ new Date()).toString().split(" (")[0];
@@ -4752,11 +5067,12 @@ async function getOrLaunchSharedBrowser(browserType = "chromium", headless = con
 async function clearVisibleChallenge(page) {
   if (page.isClosed()) return;
   if (config.captcha.enabled) {
-    await solveBaxiaCaptcha(page, {
+    await solveVisibleCaptcha(page, {
       waitForMs: 0,
       maxAttempts: config.captcha.maxAttempts,
       retryDelayMs: config.captcha.retryDelayMs,
-      settleMs: config.captcha.settleMs
+      settleMs: config.captcha.settleMs,
+      sliderTimeoutMs: config.captcha.sliderTimeoutMs
     }).catch(() => false);
   }
   try {
@@ -5369,6 +5685,7 @@ async function getBasicHeaders(accountId) {
               mobile = data.mobile ? "?1" : "?0";
             }
             let bundleVersion = null;
+            let baxiaVersion = null;
             try {
               const el = document.querySelector('link[href*="qwen-chat-fe"], script[src*="qwen-chat-fe"], img[src*="qwen-chat-fe"]');
               const src = el ? el.getAttribute("href") || el.getAttribute("src") || "" : "";
@@ -5376,7 +5693,14 @@ async function getBasicHeaders(accountId) {
               if (match) bundleVersion = match[1];
             } catch {
             }
-            return { ua, secChUa, platform, mobile, bundleVersion };
+            try {
+              const baxia = window.baxiaCommon;
+              if (typeof baxia?.version === "string") {
+                baxiaVersion = baxia.version;
+              }
+            } catch {
+            }
+            return { ua, secChUa, platform, mobile, bundleVersion, baxiaVersion };
           }),
           config.timeouts.page,
           `User-agent lookup timed out for ${accountId}`
@@ -5385,6 +5709,9 @@ async function getBasicHeaders(accountId) {
         if (nav.bundleVersion) {
           updateQwenWebVersion(nav.bundleVersion);
         }
+        if (nav.baxiaVersion) {
+          updateQwenBxVersion(nav.baxiaVersion);
+        }
         cachedUserAgents.set(accountId, userAgent);
         const hints = getHeaderCache(accountId).headers;
         clientHints = {
@@ -5416,7 +5743,7 @@ async function getBasicHeaders(accountId) {
       markAccountHeadersReady(accountId);
       const bxUa2 = cache3.headers["bx-ua"];
       const bxUmidtoken2 = cache3.headers["bx-umidtoken"];
-      const bxV2 = cache3.headers["bx-v"] || "2.5.37";
+      const bxV2 = cache3.headers["bx-v"] || getQwenBxVersion();
       const cookie2 = await getCookies(accountId);
       return { cookie: cookie2, userAgent, bxV: bxV2, bxUa: bxUa2, bxUmidtoken: bxUmidtoken2, ...clientHints };
     }
@@ -5427,7 +5754,7 @@ async function getBasicHeaders(accountId) {
         cookieCaches.set(accountId, { cookie: cookie2, timestamp: Date.now() });
         const bxUa2 = cache3.headers["bx-ua"];
         const bxUmidtoken2 = cache3.headers["bx-umidtoken"];
-        const bxV2 = cache3.headers["bx-v"] || "2.5.37";
+        const bxV2 = cache3.headers["bx-v"] || getQwenBxVersion();
         cache3.lastRefresh = Date.now();
         markAccountHeadersReady(accountId);
         console.log(
@@ -5447,14 +5774,15 @@ async function getBasicHeaders(accountId) {
           `\u26A0\uFE0F  [Playwright] Header refresh failed for ${accountId}; retaining the previous valid cache: ${getErrorMessage(error)}`
         );
       }
-    } else if (hadUsableHeaders && headersAge > HEADER_CACHE_TTL * HEADER_REFRESH_THRESHOLD && !cache3.refreshInProgress) {
-      cache3.refreshInProgress = true;
+    } else if (hadUsableHeaders && headersAge > HEADER_CACHE_TTL * HEADER_REFRESH_THRESHOLD && !cache3.refreshInProgress && // Header capture types into the chat input and sends a probe message on
+    // the account's page. Doing that while the account is serving a stream
+    // would mutate the live conversation (and can navigate the SPA), so the
+    // proactive refresh waits until the account has no active lease.
+    !hasActiveAccountLease(accountId)) {
       refreshHeadersInternal(accountId).catch((error) => {
         console.warn(
           `\u26A0\uFE0F  [Playwright] Background header refresh failed for ${accountId}: ${getErrorMessage(error)}`
         );
-      }).finally(() => {
-        cache3.refreshInProgress = false;
       });
     }
     if (!hasRequiredQwenHeaders(cache3.headers)) {
@@ -5501,6 +5829,9 @@ async function getBasicHeaders(accountId) {
             if (persisted.version) {
               updateQwenWebVersion(persisted.version);
             }
+            if (persisted.bxV) {
+              updateQwenBxVersion(persisted.bxV);
+            }
             cache3.lastRefresh = persisted.capturedAt;
             markAccountHeadersReady(accountId);
           }
@@ -5528,7 +5859,7 @@ async function getBasicHeaders(accountId) {
     markAccountHeadersReady(accountId);
     const bxUa = cache3.headers["bx-ua"];
     const bxUmidtoken = cache3.headers["bx-umidtoken"];
-    const bxV = cache3.headers["bx-v"] || "2.5.37";
+    const bxV = cache3.headers["bx-v"] || getQwenBxVersion();
     cookieCaches.delete(accountId);
     const cookie = await getCookies(accountId, true);
     if (cache3.headers) {
@@ -5592,8 +5923,12 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
       if (accountPages.has(account.id)) {
         return;
       }
-      await evictIdlePlaywrightContextsToLimit().catch(() => {
-      });
+      if (config.playwright.maxActiveContexts > 0) {
+        await evictIdlePlaywrightContextsToLimit(
+          Math.max(1, config.playwright.maxActiveContexts - 1)
+        ).catch(() => {
+        });
+      }
       const profilePath = getAccountProfilePath(account.id);
       const fingerprint = getFingerprintProfile(account.id);
       const { engine, channel } = resolveBrowserEngine(browserType);
@@ -5769,6 +6104,9 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
                 if (persisted.version) {
                   updateQwenWebVersion(persisted.version);
                 }
+                if (persisted.bxV) {
+                  updateQwenBxVersion(persisted.bxV);
+                }
                 cache3.lastRefresh = persisted.capturedAt;
                 markAccountHeadersReady(account.id);
                 restoredFromDb = true;
@@ -5862,7 +6200,7 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
         if (!acctPage.isClosed()) {
           try {
             const currentUrl = new URL(acctPage.url());
-            if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+            if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname.includes("/auth") || currentUrl.pathname.includes("/login") || currentUrl.pathname.includes("_____tmd_____")) {
               await acctPage.goto(qwenUrl("/"), {
                 waitUntil: "domcontentloaded",
                 timeout: config.timeouts.navigation
@@ -5880,6 +6218,8 @@ async function initPlaywrightForAccount(rawAccount, headless = config.playwright
     } finally {
       release();
     }
+    await evictIdlePlaywrightContextsToLimit().catch(() => {
+    });
   })();
   try {
     await initPromise;
@@ -6116,7 +6456,7 @@ async function startEmailOtpLogin(email, options = {}) {
       {
         email: normalizedEmail,
         requestId,
-        version: getQwenWebVersion() || "0.3.26",
+        version: getQwenWebVersion(),
         timezone: formatAsciiTimezone()
       }
     ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
@@ -6211,7 +6551,7 @@ async function verifyEmailOtpLogin(sessionId, code) {
       email: session.email,
       code: cleanCode,
       requestId,
-      version: getQwenWebVersion() || "0.3.26",
+      version: getQwenWebVersion(),
       timezone: formatAsciiTimezone()
     }
   ).catch((err) => ({ ok: false, error: err?.message || String(err) }));
@@ -6258,8 +6598,8 @@ async function verifyEmailOtpLogin(sessionId, code) {
     saveAuthSession2(session.accountId, {
       cookie: `token=${accessToken}`,
       userAgent: session.fingerprint.userAgent,
-      bxV: "2.5.37",
-      version: getQwenWebVersion() || "0.3.26",
+      bxV: getQwenBxVersion(),
+      version: getQwenWebVersion(),
       userId: userId || void 0,
       tokenExpiresAt: exp || void 0,
       refreshToken: refreshToken || void 0,
@@ -6369,7 +6709,7 @@ async function loginToQwen(accountId, email, password) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || "",
-            bxV: cache3.headers["bx-v"] || "2.5.37",
+            bxV: cache3.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache3.headers["bx-ua"] || "",
             bxUmidtoken: cache3.headers["bx-umidtoken"] || "",
             secChUa: cache3.headers["sec-ch-ua"] || void 0,
@@ -6441,7 +6781,7 @@ async function loginToQwen(accountId, email, password) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || "",
-            bxV: cache3.headers["bx-v"] || "2.5.37",
+            bxV: cache3.headers["bx-v"] || getQwenBxVersion(),
             bxUa: cache3.headers["bx-ua"] || "",
             bxUmidtoken: cache3.headers["bx-umidtoken"] || "",
             secChUa: cache3.headers["sec-ch-ua"] || void 0,
@@ -6512,7 +6852,7 @@ async function loginViaApi(page, email, password) {
     }
     const signinUrl = "https://auth.qwen.ai/api/v2/auths/signin";
     const requestId = crypto5.randomUUID();
-    const webVersion = getQwenWebVersion() || "0.3.26";
+    const webVersion = getQwenWebVersion();
     const evalRes = await page.evaluate(
       async ({ email: email2, password: password2, signinUrl: signinUrl2, requestId: requestId2, tz, version }) => {
         try {
@@ -6684,6 +7024,15 @@ async function loginViaUi(page, email, password) {
     if (!page.url().includes("/auth") && await isPageLoggedIn(page, 3e3).catch(() => false)) {
       return { success: true };
     }
+    if (config.captcha.enabled) {
+      await solveVisibleCaptcha(page, {
+        waitForMs: 1500,
+        maxAttempts: config.captcha.maxAttempts,
+        retryDelayMs: config.captcha.retryDelayMs,
+        settleMs: config.captcha.settleMs,
+        sliderTimeoutMs: config.captcha.sliderTimeoutMs
+      }).catch(() => false);
+    }
     const emailSelector = [
       'input[type="email"]',
       'input[name="email"]',
@@ -6839,10 +7188,11 @@ async function loginViaUi(page, email, password) {
     while (Date.now() < postSubmitDeadline) {
       if (page.isClosed()) break;
       if (config.captcha.enabled) {
-        await solveBaxiaCaptcha(page, {
+        await solveVisibleCaptcha(page, {
           waitForMs: 1500,
           maxAttempts: config.captcha.maxAttempts,
-          retryDelayMs: config.captcha.retryDelayMs
+          retryDelayMs: config.captcha.retryDelayMs,
+          sliderTimeoutMs: config.captcha.sliderTimeoutMs
         }).catch(() => {
         });
       }
@@ -6965,7 +7315,7 @@ async function refreshAccountToken(accountId) {
   }
   if (refreshToken) {
     try {
-      const webVersion = getQwenWebVersion() || "0.3.26";
+      const webVersion = getQwenWebVersion();
       const refreshResult = await page.evaluate(
         async ({ rTok, tz, version }) => {
           try {
@@ -7030,7 +7380,7 @@ async function refreshAccountToken(accountId) {
           saveAuthSession2(accountId, {
             cookie: cookieStr,
             userAgent: cache3.headers["user-agent"] || session?.userAgent || "",
-            bxV: cache3.headers["bx-v"] || session?.bxV || "2.5.37",
+            bxV: cache3.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
             bxUa: cache3.headers["bx-ua"] || session?.bxUa || "",
             bxUmidtoken: cache3.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
             secChUa: cache3.headers["sec-ch-ua"] || session?.secChUa,
@@ -7065,7 +7415,7 @@ async function refreshAccountToken(accountId) {
         saveAuthSession2(accountId, {
           cookie: cookieStr,
           userAgent: cache3.headers["user-agent"] || session?.userAgent || "",
-          bxV: cache3.headers["bx-v"] || session?.bxV || "2.5.37",
+          bxV: cache3.headers["bx-v"] || session?.bxV || getQwenBxVersion(),
           bxUa: cache3.headers["bx-ua"] || session?.bxUa || "",
           bxUmidtoken: cache3.headers["bx-umidtoken"] || session?.bxUmidtoken || "",
           secChUa: cache3.headers["sec-ch-ua"] || session?.secChUa,
@@ -7213,7 +7563,7 @@ async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.ti
           cookie: reqHeaders["cookie"] || "",
           "bx-ua": reqHeaders["bx-ua"] || "",
           "bx-umidtoken": reqHeaders["bx-umidtoken"] || "",
-          "bx-v": reqHeaders["bx-v"] || "2.5.37",
+          "bx-v": reqHeaders["bx-v"] || getQwenBxVersion(),
           "user-agent": reqHeaders["user-agent"] || "",
           "x-request-id": reqHeaders["x-request-id"] || "",
           "version": reqHeaders["version"] || "",
@@ -7245,6 +7595,9 @@ async function captureQwenHeaders(accountId, pageOverride, timeoutMs = config.ti
         if (capturedHeaders["version"]) {
           updateQwenWebVersion(capturedHeaders["version"]);
         }
+        if (capturedHeaders["bx-v"]) {
+          updateQwenBxVersion(capturedHeaders["bx-v"]);
+        }
         markAccountHeadersReady(accountId);
         cache3.lastRefresh = Date.now();
         cookieCaches.delete(accountId);
@@ -7648,19 +8001,26 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
         await executeReauth();
       } else {
         try {
-          await page.goto(qwenUrl("/"), {
-            waitUntil: "domcontentloaded",
-            timeout: Math.min(
-              config.timeouts.navigation,
-              boundedTimeoutMs,
-              SESSION_PROBE_NAVIGATION_TIMEOUT_MS
-            )
-          });
-          await sleep2(2e3);
-          const url = page.url();
+          const currentUrl = typeof page.url === "function" ? page.url() : "";
+          const needsNavigation = !currentUrl.startsWith(qwenOrigin()) || currentUrl.includes("/auth") || currentUrl.includes("/login") || currentUrl.includes("_____tmd_____");
+          if (needsNavigation) {
+            await page.goto(qwenUrl("/"), {
+              waitUntil: "domcontentloaded",
+              timeout: Math.min(
+                config.timeouts.navigation,
+                boundedTimeoutMs,
+                SESSION_PROBE_NAVIGATION_TIMEOUT_MS
+              )
+            });
+            await sleep2(2e3);
+          }
+          const url = typeof page.url === "function" ? page.url() : "";
           const isAuthUrl = url.includes("auth") || url.includes("login");
           if (isAuthUrl) {
-            await executeReauth();
+            const refreshed = await refreshAccountToken(accountId);
+            if (!refreshed.success) {
+              await executeReauth();
+            }
           }
         } catch (navErr) {
           console.warn(
@@ -7695,7 +8055,7 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
             saveAuthSession2(accountId, {
               cookie: cookieStr,
               userAgent: cache3.headers["user-agent"] || "",
-              bxV: cache3.headers["bx-v"] || "2.5.37",
+              bxV: cache3.headers["bx-v"] || getQwenBxVersion(),
               bxUa: cache3.headers["bx-ua"] || "",
               bxUmidtoken: cache3.headers["bx-umidtoken"] || "",
               secChUa: cache3.headers["sec-ch-ua"] || void 0,
@@ -7717,7 +8077,7 @@ async function refreshHeadersInternal(accountId, timeoutMs = config.timeouts.hea
     if (capturedPage && !capturedPage.isClosed()) {
       try {
         const currentUrl = new URL(capturedPage.url());
-        if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname !== "/") {
+        if (currentUrl.origin !== qwenOrigin() || currentUrl.pathname.includes("/auth") || currentUrl.pathname.includes("/login") || currentUrl.pathname.includes("_____tmd_____")) {
           await capturedPage.goto(qwenUrl("/"), {
             waitUntil: "domcontentloaded",
             timeout: Math.min(config.timeouts.navigation, boundedTimeoutMs)
@@ -8033,7 +8393,11 @@ function priorityOrderForEviction(accountIds) {
   const ranked = getAccountsByPriority(accountIds.map((id) => ({ id })));
   const rank = /* @__PURE__ */ new Map();
   for (const [index, account] of ranked.entries()) {
-    rank.set(account.id, index);
+    if (getAccountCooldownInfo(account.id)) {
+      rank.set(account.id, Number.MAX_SAFE_INTEGER);
+    } else {
+      rank.set(account.id, index);
+    }
   }
   return orderContextsForEviction(
     accountIds,
@@ -8070,14 +8434,15 @@ async function closeIdlePlaywrightAccounts(idleMs) {
   }
   return closed;
 }
-async function evictIdlePlaywrightContextsToLimit() {
-  const max = config.playwright.maxActiveContexts;
-  if (max <= 0) return 0;
+async function evictIdlePlaywrightContextsToLimit(targetLimit) {
+  const configuredMax = config.playwright.maxActiveContexts;
+  if (configuredMax <= 0) return 0;
+  const max = targetLimit !== void 0 ? Math.max(0, targetLimit) : configuredMax;
   if (accountPages.size <= max) return 0;
   const candidates = priorityOrderForEviction(
     Array.from(accountPages.keys()).filter((accountId) => {
       if (isAccountServingStream(accountId)) return false;
-      if (isAccountRecentlyActive(accountId, 3e4)) return false;
+      if (hasActiveAccountLease(accountId)) return false;
       const mutex = accountMutexes.get(accountId);
       return mutex?.isIdle();
     })
@@ -8090,6 +8455,7 @@ async function evictIdlePlaywrightContextsToLimit() {
   for (const candidate of candidates) {
     if (accountPages.size <= max) break;
     if (isAccountServingStream(candidate.accountId)) continue;
+    if (hasActiveAccountLease(candidate.accountId)) continue;
     const mutex = accountMutexes.get(candidate.accountId);
     if (!mutex?.isIdle()) continue;
     await closePlaywrightForAccount(candidate.accountId).catch((error) => {
@@ -8520,12 +8886,13 @@ var init_watchdog = __esm({
         await new Promise((resolve) => setTimeout(resolve, 100));
         this.emit("recovery:ram:freed");
         try {
-          const { closeIdlePlaywrightAccounts: closeIdlePlaywrightAccounts2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+          const { closeIdlePlaywrightAccounts: closeIdlePlaywrightAccounts2, evictIdlePlaywrightContextsToLimit: evictIdlePlaywrightContextsToLimit2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+          const evicted = await evictIdlePlaywrightContextsToLimit2(1);
           const closed = await closeIdlePlaywrightAccounts2(
             config.sessionKeeper.idleMs
           );
-          if (closed > 0) {
-            this.emit("recovery:ram:contexts-closed", closed);
+          if (evicted + closed > 0) {
+            this.emit("recovery:ram:contexts-closed", evicted + closed);
           }
         } catch {
         }
@@ -8691,13 +9058,13 @@ async function getBasicHeaders2(accountId) {
     return {
       cookie: "token=mock",
       userAgent: "mock",
-      bxV: "2.5.37",
+      bxV: getQwenBxVersion(),
       bxUa: "mock-bx-ua",
       bxUmidtoken: "mock-bx-umidtoken",
       secChUa: "",
       secChUaMobile: "?0",
       secChUaPlatform: "",
-      version: "0.3.26"
+      version: getQwenWebVersion()
     };
   }
   const resolvedAccountId = accountId ?? loadAccounts()[0]?.id;
@@ -8758,6 +9125,7 @@ var init_auth_playwright = __esm({
     init_errors();
     init_accounts();
     init_config();
+    init_qwen_headers();
     init_playwright();
     init_jwt();
   }
@@ -8882,6 +9250,7 @@ var init_model_alias = __esm({
     DEFAULT_FALLBACK_MODELS = [
       "qwen3.8-max",
       "qwen3.7-plus",
+      "qwen4.0-max-preview",
       "qwen3.8-omni-flash",
       "qwen3.7-max",
       "qwen3.6-plus",
@@ -9208,6 +9577,7 @@ var init_model_registry = __esm({
 var captcha_coordinator_exports = {};
 __export(captcha_coordinator_exports, {
   isCaptchaRecoveryActive: () => isCaptchaRecoveryActive,
+  isCaptchaRecoveryInBackoff: () => isCaptchaRecoveryInBackoff,
   recoverBaxiaCaptcha: () => recoverBaxiaCaptcha,
   solveChallengeOnPage: () => solveChallengeOnPage
 });
@@ -9227,9 +9597,10 @@ async function solveChallengeOnPage(page, challengeUrl, waitForMs = config.captc
   const solverOptions = {
     maxAttempts: config.captcha.maxAttempts,
     retryDelayMs: config.captcha.retryDelayMs,
-    settleMs: config.captcha.settleMs
+    settleMs: config.captcha.settleMs,
+    sliderTimeoutMs: config.captcha.sliderTimeoutMs
   };
-  if (await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+  if (await solveVisibleCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
     return true;
   }
   logBaxiaCaptcha(
@@ -9239,13 +9610,18 @@ async function solveChallengeOnPage(page, challengeUrl, waitForMs = config.captc
   );
   await gotoBestEffort(page, challengeUrl ?? qwenUrl("/"));
   try {
-    return await solveBaxiaCaptcha(page, { ...solverOptions, waitForMs });
+    return await solveVisibleCaptcha(page, { ...solverOptions, waitForMs });
   } finally {
     if (page.url().includes(CHALLENGE_PATH_MARKER)) {
       await gotoBestEffort(page, qwenUrl("/"));
     }
   }
 }
+function isCaptchaRecoveryInBackoff(accountId) {
+  if (!accountId) return false;
+  const lastFailure = lastFailedRecoveryAt.get(accountId) ?? 0;
+  return Date.now() - lastFailure < FAILED_RECOVERY_BACKOFF_MS;
+}
 async function recoverBaxiaCaptcha(accountId, label, options = {}) {
   if (!config.captcha.enabled || !accountId) return false;
   const solver = "baxia";
@@ -9263,17 +9639,35 @@ async function recoverBaxiaCaptcha(accountId, label, options = {}) {
   const challengeUrl = options.challengeBody ? extractBaxiaChallengeUrl(options.challengeBody, config.qwen.baseUrl) : null;
   activeCaptchaRecoveries.add(accountId);
   try {
-    const { abortActiveBrowserStreamsForAccount: abortActiveBrowserStreamsForAccount2 } = await Promise.resolve().then(() => (init_qwen(), qwen_exports));
-    abortActiveBrowserStreamsForAccount2(
-      accountId,
-      "Account stream interrupted by captcha challenge recovery"
-    );
-  } catch {
-  }
-  try {
+    const { hasActiveBrowserStreamsForAccount: hasActiveBrowserStreamsForAccount2 } = await Promise.resolve().then(() => (init_qwen(), qwen_exports));
+    const hasConcurrentStream = hasActiveBrowserStreamsForAccount2(accountId);
     const solved = await withAccountPage(
       accountId,
-      (page) => solveChallengeOnPage(page, challengeUrl),
+      async (page) => {
+        if (hasConcurrentStream) {
+          const solverOptions = {
+            maxAttempts: config.captcha.maxAttempts,
+            retryDelayMs: config.captcha.retryDelayMs,
+            settleMs: config.captcha.settleMs,
+            sliderTimeoutMs: config.captcha.sliderTimeoutMs
+          };
+          if (await solveVisibleCaptcha(page, { ...solverOptions, waitForMs: 0 })) {
+            return true;
+          }
+          const ctx = typeof page.context === "function" ? page.context() : null;
+          if (ctx && typeof ctx.newPage === "function") {
+            const tempPage = await ctx.newPage();
+            try {
+              return await solveChallengeOnPage(tempPage, challengeUrl);
+            } finally {
+              await tempPage.close({ runBeforeUnload: false }).catch(() => {
+              });
+            }
+          }
+          return false;
+        }
+        return await solveChallengeOnPage(page, challengeUrl);
+      },
       solverOperationTimeoutMs,
       solverOperationTimeoutMs,
       false
@@ -11574,7 +11968,7 @@ var init_media_generation = __esm({
 
 // src/services/qwen-chat-pool.ts
 import crypto6 from "crypto";
-async function createQwenChatSession(headers, model, accountId, chatMode = "thread") {
+async function createQwenChatSession(headers, model, accountId, chatMode = "thread", captchaRecoveryAttempts = 1) {
   if (isAuthMockEnabled()) {
     return process.env.TEST_SESSION_ID || "mock-session";
   }
@@ -11602,16 +11996,29 @@ async function createQwenChatSession(headers, model, accountId, chatMode = "thre
   if (!chatId || typeof chatId !== "string") {
     const rawLower = raw.toLowerCase();
     if (looksLikeAntiBotChallengeText(raw)) {
-      try {
-        const { recoverBaxiaCaptcha: recoverBaxiaCaptcha2 } = await Promise.resolve().then(() => (init_captcha_coordinator(), captcha_coordinator_exports));
-        const solved = await recoverBaxiaCaptcha2(accountId, "createQwenChatSession", {
-          challengeBody: raw
-        });
-        if (solved) {
-          return createQwenChatSession(headers, model, accountId, chatMode);
+      if (captchaRecoveryAttempts > 0) {
+        try {
+          const { recoverBaxiaCaptcha: recoverBaxiaCaptcha2 } = await Promise.resolve().then(() => (init_captcha_coordinator(), captcha_coordinator_exports));
+          const solved = await recoverBaxiaCaptcha2(accountId, "createQwenChatSession", {
+            challengeBody: raw
+          });
+          if (solved) {
+            return createQwenChatSession(
+              headers,
+              model,
+              accountId,
+              chatMode,
+              captchaRecoveryAttempts - 1
+            );
+          }
+        } catch {
         }
-      } catch {
       }
+      throw new QwenUpstreamError(
+        `Qwen create chat blocked by WAF challenge: ${raw.substring(0, 300)}`,
+        "FAIL_SYS_USER_VALIDATE",
+        403
+      );
     }
     const isUnauthorized = json?.data?.code?.toLowerCase() === "unauthorized" || json?.code?.toLowerCase() === "unauthorized" || rawLower.includes("unauthorized") || rawLower.includes("permission to access") || rawLower.includes("token has expired") || rawLower.includes("401");
     if (isUnauthorized) {
@@ -11788,6 +12195,20 @@ async function refillQwenChatPool(headers, model, accountId) {
         console.warn(
           `[WarmPool] Account ${accountId || "global"} rate-limited during chat creation. Marked for cooldown.`
         );
+      } else if (accountId && (err.upstreamCode === "FAIL_SYS_USER_VALIDATE" || err.upstreamCode === "RGV587_ERROR" || /_____tmd_____|rgv587_error|fail_sys_user_validate/i.test(
+        err.message
+      ))) {
+        const existing = getAccountCooldownInfo(accountId);
+        if (existing?.reason === "WafChallenge") {
+          console.warn(
+            `[WarmPool] Account ${accountId} still on WAF quarantine (${Math.ceil(existing.remainingMs / 1e3)}s left); skipping re-escalation.`
+          );
+        } else {
+          const block = recordWafHardBlock(accountId);
+          console.warn(
+            `[WarmPool] Unsolved WAF challenge on ${accountId} during chat creation; quarantined ${Math.ceil(block.cooldownMs / 1e3)}s and rotated the fingerprint.`
+          );
+        }
       }
     }
     if (isToolcallDebugEnabled()) {
@@ -11823,6 +12244,7 @@ var init_qwen_chat_pool = __esm({
     init_config();
     init_logger();
     init_account_manager();
+    init_waf_isolation();
     init_model_alias();
     init_qwen_url();
     init_qwen_errors();
@@ -11872,6 +12294,7 @@ __export(qwen_exports, {
   getLogicalThreadState: () => getLogicalThreadState,
   getQwenErrorCode: () => getQwenErrorCode,
   getSessionParent: () => getSessionParent,
+  hasActiveBrowserStreamsForAccount: () => hasActiveBrowserStreamsForAccount,
   invalidateLogicalThreadParent: () => invalidateLogicalThreadParent,
   isChatSessionActive: () => isChatSessionActive,
   isRetryableFetchErrorMessage: () => isRetryableFetchErrorMessage,
@@ -11893,6 +12316,14 @@ __export(qwen_exports, {
 });
 import crypto7 from "crypto";
 import { v4 as uuidv43 } from "uuid";
+function hasActiveBrowserStreamsForAccount(accountId) {
+  for (const state of browserStreamStates.values()) {
+    if (state.accountId === accountId && !state.done) {
+      return true;
+    }
+  }
+  return false;
+}
 function abortActiveBrowserStreamsForAccount(accountId, reason = "Account browser stream interrupted (page context unloaded)") {
   let count = 0;
   for (const [requestId, state] of browserStreamStates) {
@@ -12383,7 +12814,7 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
     browserHeaders["Content-Type"] = "application/json";
   }
   const evaluateRequest = (page) => page.evaluate(
-    async ({ url: url2, method: method2, headers: headers2, body: body2, referrer, timeoutMs, tz }) => {
+    async ({ url: url2, method: method2, headers: headers2, body: body2, referrer, timeoutMs, tz, version }) => {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
       try {
@@ -12405,7 +12836,7 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
                 headers: {
                   accept: "application/json, text/plain, */*",
                   source: "web",
-                  version: "0.3.11",
+                  version,
                   "x-request-origin": "https://chat.qwen.ai",
                   timezone: tz,
                   authorization: `Bearer ${rTok}`
@@ -12453,7 +12884,8 @@ async function requestQwenTextInBrowser(accountId, method, path21, headers, body
       body,
       referrer: options.referrer,
       timeoutMs: options.timeoutMs ?? Math.min(config.timeouts.page, 2e4),
-      tz: formatAsciiTimezone()
+      tz: formatAsciiTimezone(),
+      version: getQwenWebVersion()
     }
   );
   const recoverOnTimeout = !options.noMutexRecovery;
@@ -12670,7 +13102,7 @@ async function createQwenBrowserResponse(accountId, url, method, headers, body,
           const onFrameNavigated = (frame) => {
             if (!settled && typeof page.mainFrame === "function" && frame === page.mainFrame()) {
               const url2 = typeof frame.url === "function" ? frame.url() : String(frame.url || "");
-              if (url2.startsWith(qwenOrigin()) && !url2.includes("/auth") && !url2.includes("_____tmd_____") && !url2.includes("/punish")) {
+              if (url2.startsWith(qwenOrigin()) && !url2.includes("/auth") && !url2.includes("/login") && !url2.includes("_____tmd_____") && !url2.includes("/punish")) {
                 return;
               }
               handleBrowserStreamEvent(requestId, {
@@ -12691,10 +13123,12 @@ async function createQwenBrowserResponse(accountId, url, method, headers, body,
           };
           page.on("framenavigated", onFrameNavigated);
           page.on("close", onPageClosed);
+          page.on("crash", onPageClosed);
           pageCleanup = () => {
             try {
               page.off?.("framenavigated", onFrameNavigated);
               page.off?.("close", onPageClosed);
+              page.off?.("crash", onPageClosed);
             } catch {
             }
           };
@@ -13408,7 +13842,7 @@ async function deleteSingleQwenChat(accountId, chatId) {
   }
   const requestHeaders = {
     source: "web",
-    version: getQwenWebVersion() || "0.3.26",
+    version: getQwenWebVersion(),
     timezone: formatAsciiTimezone(),
     "x-request-id": crypto7.randomUUID(),
     Referer: qwenUrl(`/c/${encodeURIComponent(chatId)}`)
@@ -13452,7 +13886,7 @@ async function fetchRemoteQwenChats(accountId) {
     return [];
   }
   const requestHeaders = {
-    version: getQwenWebVersion() || "0.3.26",
+    version: getQwenWebVersion(),
     timezone: formatAsciiTimezone(),
     "x-request-id": crypto7.randomUUID(),
     Referer: qwenUrl("/settings/chats")
@@ -16843,7 +17277,16 @@ async function deleteChatsForAccountId(accountId) {
   if (!credentials) {
     throw new Error(`Credenciais da conta ${account.email} n\xE3o encontradas.`);
   }
-  return deleteChatsForAccount(credentials);
+  const wasInitialized = isPlaywrightInitialized(account.id);
+  try {
+    return await deleteChatsForAccount(credentials);
+  } finally {
+    if (!wasInitialized && !isAuthMockEnabled()) {
+      const { closePlaywrightForAccount: closePlaywrightForAccount2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
+      await closePlaywrightForAccount2(account.id).catch(() => {
+      });
+    }
+  }
 }
 async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false) {
   const accounts = loadAccounts();
@@ -16858,6 +17301,7 @@ async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false) {
       const account = accounts[i];
       const currentIdx = i + 1;
       const totalCount = accounts.length;
+      const wasInitialized = isPlaywrightInitialized(account.id);
       try {
         const ok = await deleteChatsForAccount(account, currentIdx, totalCount);
         if (ok) succeeded++;
@@ -16867,7 +17311,7 @@ async function deleteChatsForConfiguredAccounts(keepBrowserOpen = false) {
           error instanceof Error ? error.message : String(error)
         );
       } finally {
-        if (!keepBrowserOpen) {
+        if ((!keepBrowserOpen || !wasInitialized) && !isAuthMockEnabled()) {
           const { closePlaywrightForAccount: closePlaywrightForAccount2 } = await Promise.resolve().then(() => (init_playwright(), playwright_exports));
           await closePlaywrightForAccount2(account.id).catch(() => {
           });
@@ -18154,6 +18598,9 @@ ${loopReminder}` : truncation.prompt;
     if (policy.reason === "corrupted_chat_history") {
       invalidateLogicalThreadParent(params.sessionId);
     }
+    if (policy.reason === "anti_bot" && isCaptchaRecoveryInBackoff(currentAccountId)) {
+      return { success: false, error: err };
+    }
     const retryInvalidInputOnSameAccount = shouldRetryInvalidInputOnSameAccount(
       policy.reason,
       invalidInputSameAccountRetried
@@ -18342,6 +18789,7 @@ var init_account = __esm({
     init_account_manager();
     init_account_priority();
     init_waf_isolation();
+    init_captcha_coordinator();
     init_accounts();
     init_config();
     init_errors();
@@ -21965,8 +22413,8 @@ async function processStreamingResponse(params) {
         );
       };
       const emitAnswerText = async (textChunk) => {
-        if (textChunk) emittedModelOutput = true;
         if (!toolParser) {
+          if (textChunk) emittedModelOutput = true;
           finalContent += textChunk;
           writeDeltaEvent({ content: textChunk });
           return;
@@ -22342,6 +22790,23 @@ async function processStreamingResponse(params) {
           if (fastMatch) {
             const unescaped = fastMatch[1].replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
             if (unescaped) {
+              if (!emittedModelOutput && isOverloadMessage(unescaped)) {
+                const overloadErr = toRetryableStreamError(
+                  "server_overloaded",
+                  unescaped,
+                  {
+                    switchAccount: true,
+                    forceNewChat: true,
+                    reason: "server_busy",
+                    accountCooldownMs: OVERLOAD_COOLDOWN_MS,
+                    accountCooldownReason: "ServerOverloaded"
+                  }
+                );
+                if (await recoverFromStreamError(overloadErr)) {
+                  break;
+                }
+                throw overloadErr;
+              }
               const result = getIncrementalDelta(
                 lastRawContent,
                 unescaped,
@@ -22476,7 +22941,6 @@ async function processStreamingResponse(params) {
             if (foundStr && vStr !== "") {
               if (vStr === "FINISHED") continue;
               if (isThinkingChunk) {
-                emittedModelOutput = true;
                 reasoningBuffer += vStr;
                 writeDeltaEvent({ reasoning_content: vStr });
               } else {
@@ -27111,11 +27575,42 @@ var init_server_log_buffer = __esm({
 // src/services/session-keeper.ts
 var session_keeper_exports = {};
 __export(session_keeper_exports, {
+  computeSessionKeeperBackoffMs: () => computeSessionKeeperBackoffMs,
+  isSessionKeeperAccountBackedOff: () => isSessionKeeperAccountBackedOff,
   isSessionKeeperRunning: () => isSessionKeeperRunning,
+  resetSessionKeeperRetryStateForTests: () => resetSessionKeeperRetryStateForTests,
   runSessionKeeperOnceForTesting: () => runSessionKeeperOnceForTesting,
   startSessionKeeper: () => startSessionKeeper,
   stopSessionKeeper: () => stopSessionKeeper
 });
+function computeSessionKeeperBackoffMs(failures) {
+  const exponent = Math.max(0, Math.min(failures - 1, 8));
+  return Math.min(
+    KEEP_ALIVE_BACKOFF_MAX_MS,
+    KEEP_ALIVE_BACKOFF_BASE_MS * 2 ** exponent
+  );
+}
+function isKeepAliveBackedOff(accountId) {
+  const state = keepAliveRetries.get(accountId);
+  return Boolean(state && Date.now() < state.nextAttemptAt);
+}
+function recordKeepAliveFailure(accountId) {
+  const state = keepAliveRetries.get(accountId) ?? {
+    failures: 0,
+    nextAttemptAt: 0
+  };
+  state.failures += 1;
+  const backoffMs = computeSessionKeeperBackoffMs(state.failures);
+  state.nextAttemptAt = Date.now() + backoffMs;
+  keepAliveRetries.set(accountId, state);
+  return backoffMs;
+}
+function resetSessionKeeperRetryStateForTests() {
+  keepAliveRetries.clear();
+}
+function isSessionKeeperAccountBackedOff(accountId) {
+  return isKeepAliveBackedOff(accountId);
+}
 function isSessionKeeperRunning() {
   return running;
 }
@@ -27126,13 +27621,25 @@ async function runKeepAliveCycle() {
     if (config.sessionKeeper.enabled) {
       const accountIds = getActivePlaywrightAccountIds();
       for (const accountId of accountIds) {
-        await keepAlivePlaywrightAccount(accountId).catch((error) => {
-          if (isPlaywrightAlreadyClosedError(error)) return;
-          const message = error instanceof Error ? error.message : String(error);
-          console.warn(
-            `[SessionKeeper] Keep-alive failed for ${accountId}: ${message}`
-          );
-        });
+        if (isKeepAliveBackedOff(accountId)) {
+          continue;
+        }
+        try {
+          const keptAlive = await keepAlivePlaywrightAccount(accountId);
+          if (keptAlive) {
+            keepAliveRetries.delete(accountId);
+          }
+        } catch (error) {
+          if (isPlaywrightAlreadyClosedError(error)) {
+            keepAliveRetries.delete(accountId);
+          } else {
+            const message = error instanceof Error ? error.message : String(error);
+            const backoffMs = recordKeepAliveFailure(accountId);
+            console.warn(
+              `[SessionKeeper] Keep-alive failed for ${accountId}: ${message} (retry in ${Math.round(backoffMs / 1e3)}s)`
+            );
+          }
+        }
         await sleep(humanDelay(250, 900));
       }
     }
@@ -27172,11 +27679,12 @@ function stopSessionKeeper() {
     intervalId = null;
   }
   cycleInProgress = false;
+  keepAliveRetries.clear();
 }
 async function runSessionKeeperOnceForTesting() {
   await runKeepAliveCycle();
 }
-var running, intervalId, cycleInProgress;
+var running, intervalId, cycleInProgress, KEEP_ALIVE_BACKOFF_BASE_MS, KEEP_ALIVE_BACKOFF_MAX_MS, keepAliveRetries;
 var init_session_keeper = __esm({
   "src/services/session-keeper.ts"() {
     "use strict";
@@ -27186,6 +27694,9 @@ var init_session_keeper = __esm({
     running = false;
     intervalId = null;
     cycleInProgress = false;
+    KEEP_ALIVE_BACKOFF_BASE_MS = 2e3;
+    KEEP_ALIVE_BACKOFF_MAX_MS = 5 * 6e4;
+    keepAliveRetries = /* @__PURE__ */ new Map();
   }
 });
 
@@ -27211,7 +27722,7 @@ function getAppVersion() {
     }
   } catch {
   }
-  cachedVersion = "v1.6.10";
+  cachedVersion = "v1.6.12";
   return cachedVersion;
 }
 var cachedVersion;
@@ -27617,10 +28128,11 @@ async function startServer(options) {
       } else if (remainingAccounts.length > 0) {
         void (async () => {
           const { ensureAccountInPriority: ensureAccountInPriority2 } = await Promise.resolve().then(() => (init_account_priority(), account_priority_exports));
-          const targetWarmTotal = Math.min(
+          const maxWarmCap = config.playwright.maxActiveContexts > 0 ? Math.min(
             config.playwright.startupWarmAccounts,
-            totalAccounts
-          );
+            config.playwright.maxActiveContexts
+          ) : config.playwright.startupWarmAccounts;
+          const targetWarmTotal = Math.min(maxWarmCap, totalAccounts);
           let currentReadyCount = readyAccountIds.size;
           if (currentReadyCount < targetWarmTotal && remainingAccounts.length > 0) {
             for (const reserveAccount of remainingAccounts) {